Eclipse Ankaios CVE-2026-85201

The attacking workload must have been explicitly granted Control Interface access by an Ankaios operator - this is a deliberate, non-default configuration step. Only workloads with this grant can write to the Control Interface FIFO. The attack is local (AV:L) and requires low-privilege execution within the Ankaios workload environment (PR:L). No user interaction is required. Exploitation is limited to deployments where Control Interface access has been delegated to untrusted or potentially malicious workloads; environments where only fully trusted workloads hold this privilege are not at practical risk from external actors.

The CVSS 4.0 score of 6.8 (Medium) with vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L is well-calibrated. The local attack vector and PR:L correctly reflect that exploitation requires a workload already granted Control Interface access - a non-default privilege that must be explicitly configured by an operator. There is no confidentiality or integrity impact (VC/VI both N), making this a pure availability concern. The SA:L captures the downstream effect on workloads that lose their orchestration services when the agent crashes. No public exploit code exists and no active exploitation is confirmed via CISA KEV. Real-world risk is limited to adversarial or compromised workloads operating within a multi-tenant or insufficiently isolated Ankaios deployment where Control Interface access has been granted to untrusted actors. Eclipse Ankaios targets niche embedded/automotive use cases, further constraining the exposed population. The primary concern is insider-threat or supply-chain scenarios where a granted workload turns malicious.

A workload granted Control Interface access writes a protobuf message to the agent FIFO with a declared length set to a value near the maximum 64-bit integer. The agent allocates a correspondingly sized buffer, exhausting available system memory, causing the Ankaios agent process to abort. All workloads previously managed by that agent instance immediately lose orchestration - they are no longer monitored, restarted on failure, or subject to lifecycle management - until the agent is restarted by an external supervisor.