CVE-2026-59675
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
When API audit logging is enabled in Rancher Manager, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier than APIBodyLimitingHandler, the body-size cap is bypassed. An unauthenticated attacker can send arbitrarily large request bodies to public login endpoints, causing memory exhaustion and termination of the Rancher Manager process.
Risk Assessment
An attacker can cause Rancher Manager to crash, leading to unavailability of the API and UI and interruption of management of all downstream clusters. This can result in service disruption and loss of control over infrastructure.
Recommendation
Update Rancher to a patched version. As a temporary measure, disable API audit logging or configure request size limits at the proxy level.
Other vulnerabilities in Rancher
See all- CVE-2026-44945Critical
A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages. This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.
- CVE-2026-55997High
Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one through the Rancher API, etcd, stored automation, or direct file access on a node, and use it at any time to register a rogue node into the cluster.
- CVE-2026-55996Medium
Rancher has a denial-of-service vulnerability in multiple TLS listeners. dynamiclistener automatically appends to each serving certificate any hostname presented via SNI, allowing an unauthenticated attacker to send a large number of TLS requests with distinct hostnames, causing the certificate to accumulate an unbounded number of SANs. Eventually, the certificate grows large enough that TLS handshakes fail, causing denial of service.
- CVE-2026-44947Medium
A missing clean-up in the legacy Project Role Template Binding (PRTB) reconciler in Rancher versions 2.13.0 up to 2.13.7 and 2.14.0 up to 2.14.3 allowed users to retain unauthorized Pod Security Admission (PSA) permissions after an administrator removes those permissions from a RoleTemplate.
- CVE-2026-44946High
A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler did not enforce one-time use of SAML assertion, potentially allowing person-in-the-middle attacks. Affects Rancher 2.14.0 before 2.14.3.
- CVE-2026-41053High
Incorrect authentication caching in the team membership expansion of the Rancher Github authentication provider caused granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.
- CVE-2026-41052High
In Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10, users with the Project Owner role can exploit improper privilege handling to escalate their privileges.
Original NVD description (English source)
When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap (default 1 MiB) is bypassed for requests that pass through the audit copyReqBody path. An unauthenticated attacker can send arbitrarily large request bodies to the public login endpoints, causing the Rancher Manager server process to allocate memory proportional to the supplied body size. With just a few concurrent connections, this can exhaust available memory and terminate the Rancher Manager plane process, making the Rancher API and UI unavailable and interrupting management of all downstream clusters.