A route author could direct controller-side discovery at an oversized endpoint. In the reported k3s test a valid 40 MiB response triggered controller OOM kills and delayed reconciliation for a route in another namespace. The 1.2.1 repair introduced a one MiB response limit. This requires permission to create the relevant route and reachable metadata…
Inspect the ClaimsCase · DiggingBeagle record
Oversized OAuth metadata could crash Agent Router shared reconciliation
A namespaced route caused the shared controller to read unbounded OAuth discovery data.
Public disclosure: Nov 6, 2026
Scope
Affected multi-namespace Agent Router Kubernetes installations using OAuth metadata discovery.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The isolated Kubernetes test records a 40 MiB response, three controller OOM restarts and 43 seconds of unrelated reconciliation delay. No production disruption has been established. An impact band remains unassigned because the available evidence does not establish a comparable severity score or verified numerical loss for this assessment.
Assessed Nov 8, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-AGENTROUTER-OAUTH-CONTROLLER-DOS-01 · CLM-ENR-AR-OAUTH-RECON · Agent Router controller OAuth metadata memory exhaustion · Agent Router version 1.2.1 release
At a glance
The scale of an untrusted metadata response can cross tenant boundaries when all namespaces share one controller process.
Read the implicationsThis requires permission to create the relevant route and reachable metadata service. The reproduced effect was in a controlled cluster, and no customer-wide outage is documented.
Limits and uncertaintyFull account
A route author could direct controller-side discovery at an oversized endpoint. In the reported k3s test a valid 40 MiB response triggered controller OOM kills and delayed reconciliation for a route in another namespace. The 1.2.1 repair introduced a one MiB response limit.
This requires permission to create the relevant route and reachable metadata service. The reproduced effect was in a controlled cluster, and no customer-wide outage is documented.
The reproduction made the cross-namespace consequence measurable: a synthetic 40 MiB OAuth metadata response exhausted a 160 MiB controller, triggered three OOM restarts and delayed an unrelated namespace's route reconciliation for 43 seconds. Only permission to create an MCPRoute was needed in the attacker's namespace. The 1.2.1 bound of 1 MiB addresses the unbounded download, while memory limits alone would leave the shared control-plane dependency exposed to repeated restarts.
Mechanism and trust boundary
- 01
Create a namespaced MCPRoute selecting an OAuth metadata endpoint.
- 02
Return a large discovery document to the shared controller.
- 03
Exhaust controller memory and interfere with reconciliation outside the initiating namespace.
Claims & evidence
CLM-ENR-AR-OAUTH-RECONIn the isolated Kubernetes reproduction, a 40 MiB metadata response killed a 160 MiB controller three times and delayed a different namespace's route reconciliation by 43 seconds.supported
Basis: reported finding
- supportsAgent Router controller OAuth metadata memory exhaustionprimary disclosure
Summary; Observed Results; Conclusion
CLM-AGENTROUTER-OAUTH-CONTROLLER-DOS-01An MCPRoute-controlled OAuth metadata endpoint could return a large JSON response and exhaust the shared Agent Router controller memory because the response used unbounded reading.supported
Basis: reported finding
- supportsAgent Router controller OAuth metadata memory exhaustionprimary disclosure
Summary; Proof-of-concept and 1.2.1 remediation
Implications
The scale of an untrusted metadata response can cross tenant boundaries when all namespaces share one controller process.
Controls and mitigations
- Apply Agent Router 1.2.1, including its 1 MiB limit for OAuth discovery metadata, and reject oversized responses without killing the shared controller.
- Test retry and reconciliation in an unrelated namespace when an attacker-controlled MCPRoute points to oversized or stalled metadata.
Unknowns and contradictions
- This requires permission to create the relevant route and reachable metadata service. The reproduced effect was in a controlled cluster, and no customer-wide outage is documented.
Sources and citation
Material revision history
- Nov 8, 2026 · Canonical change recorded · new in release · revision 229