What happened
GitLab Advisory Database / NVD documented this CVSS 7.5 High vulnerability disclosed Sept 17, 2026 in the MKP Kubernetes MCP server.
Why it matters
MCP servers that broker access to Kubernetes clusters for AI agents are a growing category; an unauthenticated single-request DoS against such a server disrupts the agent's ability to manage the cluster and, combined with the default-unauthenticated exposure common across many early MCP server implementations, illustrates the recurring pattern of weak-by-default network exposure in this ecosystem.
Attack vector
The unauthenticated get_resource MCP tool accepts attacker-controlled limitBytes and tailLines values for the Kubernetes pods logs subresource and forwards them unbounded to the Kubernetes API; the entire returned log stream is read into an in-memory buffer without any size cap, letting a single crafted tools/call request exhaust server memory and crash the MCP process (OOM kill).
Affected systems
StacklokLabs/mkp < 0.4.1
Mitigation
Upgrade to MKP >= 0.4.1; apply application-side caps on log read size and require authentication on MCP tool endpoints exposing Kubernetes resource access.