CVE-2026-55996
Received Received - Intake

Denial of Service in Rancher TLS Listeners via SNI Abuse

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: SUSE

Description
A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent component running in downstream clusters and the Rancher server itself use the dynamiclistener library to serve TLS traffic. Without an effective CN filter configured, dynamiclistener automatically appended to each serving certificate any hostname presented via Server Name Indication (SNI) in incoming TLS requests. An unauthenticated attacker with network access within the affected cluster could send a large number of TLS requests with distinct hostnames, causing the serving certificate to accumulate an unbounded number of Subject Alternative Names (SANs). Eventually, the certificate grows large enough that TLS handshakes fail with an excessive message size error, causing a denial of service on the affected listeners.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-55996
EUVD
EUVD-2026-53290

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
rancher rancher From 2.11.0 (inc) to 2.11.15 (inc)
rancher rancher From 2.12.0 (inc) to 2.12.11 (inc)
rancher rancher From 2.13.0 (inc) to 2.13.7 (inc)
rancher rancher From 2.14.0 (inc) to 2.14.3 (inc)
rancher cattle-cluster-agent *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial-of-service vulnerability in Rancher and cattle-cluster-agent caused by improper handling of TLS Server Name Indication (SNI) hostnames. An unauthenticated attacker can send many TLS requests with different hostnames, causing the serving certificate to accumulate too many Subject Alternative Names (SANs). This eventually makes TLS handshakes fail due to oversized certificate messages, disrupting service.

Detection Guidance

Monitor TLS handshake failures or excessive certificate sizes on Rancher server and cattle-cluster-agent components. Check for repeated TLS requests with distinct hostnames in logs. Use network monitoring tools to detect abnormal traffic patterns targeting TLS listeners.

Impact Analysis

It can cause service disruption by crashing TLS listeners in Rancher or cattle-cluster-agent. Attackers only need minimal Kubernetes cluster privileges and network access to exploit this, leading to downtime for affected systems.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by disrupting the availability of Rancher's TLS listeners, which may be used to secure communications in environments handling sensitive data. Denial-of-service conditions could lead to downtime, potentially affecting systems required to maintain continuous access under these regulations.

Mitigation Strategies

Upgrade Rancher to patched versions (2.11.16, 2.12.12, 2.13.8, or 2.14.4). If upgrading is not possible, restrict access to affected endpoints using Kubernetes NetworkPolicy to limit exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55996. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart