# CVE-2026-85201: Eclipse Ankaios agent unbounded memory allocation in Control Interface

Source: https://junglewise.ai/threats/cve-2026-85201-eclipse-ankaios-agent-unbounded-memory-allocation-in-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85201 · Severity: info · Published 2026-09-07

Eclipse Ankaios is a container orchestration platform that manages workloads across distributed systems. A workload with access to the Control Interface can trigger excessive memory allocation in the Ankaios agent by declaring an abnormally large message length in a protobuf message, causing the agent process to crash and interrupt orchestration services.

Technologies: [Eclipse Ankaios](https://junglewise.ai/threats/technologies/ankaios). Vendors: [Eclipse](https://junglewise.ai/threats/vendors/eclipse).

## Quick answers

**Is CVE-2026-85201 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85201 being exploited in the wild.

**How severe is CVE-2026-85201?** Informational severity, published 7 September 2026.

**Which products and versions are affected?** Eclipse Ankaios 0.1.0 through 1.0.1.

**Is there a fix for CVE-2026-85201?** A patch was published on 2026-09-04: Fixed in version 1.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85201 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-85201?** Check whether you run Eclipse Ankaios at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Ankaios agent does not validate the length field declared by a workload in length-delimited protobuf messages received through the Control Interface FIFO. A malicious or misconfigured workload can specify an excessively large message length, triggering unbounded memory allocation that exhausts available memory and terminates the agent process. This is a resource exhaustion / denial-of-service vulnerability affecting the orchestration layer. The attack requires a workload to have Control Interface access, is network-reachable through the FIFO interface, and has been fixed in version 1.0.2 via message size validation checks.

## Affected products

- Eclipse Ankaios 0.1.0 through 1.0.1

## Timeline

- 2026-09-07: disclosed
- 2026-09-04: patched: Fixed in version 1.0.2

## References

- [https://github.com/eclipse-ankaios/ankaios/pull/791](https://github.com/eclipse-ankaios/ankaios/pull/791)
- [https://github.com/eclipse-ankaios/ankaios/releases/tag/v1.0.2](https://github.com/eclipse-ankaios/ankaios/releases/tag/v1.0.2)

## Related threats

- [Eclipse Ankaios authorization bypass in log access control](https://junglewise.ai/threats/cve-2026-92611-eclipse-ankaios-authorization-bypass-in-log-access-control)
- [Eclipse Ankaios agent FIFO hijacking via predictable path](https://junglewise.ai/threats/cve-2026-86836-eclipse-ankaios-agent-fifo-hijacking-via-predictable-path)
- [Eclipse Ankaios authorization bypass via multi-segment wildcard rules](https://junglewise.ai/threats/cve-2026-84173-eclipse-ankaios-authorization-bypass-via-multi-segment-wildcard)