CVE-2026-50125

MKP (Model Context Protocol server for Kubernetes, by StacklokLabs) prior to 0.4.1 exposes an unauthenticated get_resource tool on its default port 8080 that accepts attacker-controlled limitBytes and tailLines parameters. These values are parsed as unbounded int64 in pkg/k8s/subresource.go, and ...