CVE-2026-59675
Received Received - Intake

Memory Exhaustion in Rancher Manager via Unlimited Login Requests

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: SUSE

Description
When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap (default 1 MiB) is bypassed for requests that pass through the audit copyReqBody path. An unauthenticated attacker can send arbitrarily large request bodies to the public login endpoints, causing the Rancher Manager server process to allocate memory proportional to the supplied body size. With just a few concurrent connections, this can exhaust available memory and terminate the Rancher Manager plane process, making the Rancher API and UI unavailable and interrupting management of all downstream clusters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-59675
EUVD
EUVD-2026-53291

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
rancher rancher *
rancher rancher to 2.14.3 (inc)
rancher rancher to 2.13.7 (inc)
rancher rancher to 2.12.11 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial of service vulnerability in Rancher's API audit-log middleware. When audit logging is enabled, the middleware reads entire HTTP request bodies into memory without size limits on login endpoints. Since it processes requests before Rancher's body size limiter, attackers can bypass the default 1 MiB cap by sending large payloads to public login endpoints. This causes memory exhaustion, crashing the Rancher Manager process and disrupting API/UI functionality and cluster management.

Detection Guidance

Check if API audit logging is enabled in Rancher Manager. Monitor server memory usage for unexpected spikes during login attempts. Inspect Rancher Manager logs for unusually large request bodies in audit entries.

Impact Analysis

An unauthenticated attacker can send arbitrarily large request bodies to public login endpoints. With just a few concurrent connections, this can exhaust available memory and terminate the Rancher Manager plane process. This makes the Rancher API and UI unavailable, interrupting management of all downstream clusters.

Compliance Impact

This vulnerability primarily impacts availability by causing denial of service through memory exhaustion. While it does not directly violate GDPR or HIPAA data protection requirements, it could lead to non-compliance if the outage disrupts access to critical personal or health data systems managed by Rancher. GDPR requires availability of personal data processing systems, and HIPAA mandates access to electronic protected health information.

Mitigation Strategies

Upgrade Rancher Manager to a patched version (2.14.4, 2.13.8, or 2.12.12). If upgrading is not immediately possible, disable API audit logging as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59675. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart