CVE-2026-59675: Rancher Manager Audit DoS Vulnerability

CVE-2026-59675 Overview

CVE-2026-59675 is an unauthenticated denial-of-service vulnerability in Rancher Manager. When API audit logging is enabled, the audit middleware reads the entire HTTP request body into memory before Rancher's APIBodyLimitingHandler can enforce the default 1 MiB size cap. The audit middleware sits earlier in the handler chain, so the copyReqBody path bypasses the limit for requests to public login endpoints. Attackers can submit arbitrarily large bodies to unauthenticated login endpoints, forcing the server to allocate memory proportional to the request size. A small number of concurrent connections is sufficient to exhaust available memory and terminate the Rancher Manager process.

Critical Impact
An unauthenticated attacker can crash the Rancher Manager plane and interrupt management of all downstream Kubernetes clusters.

Affected Products

Rancher Manager (versions with API audit logging enabled and the vulnerable copyReqBody audit middleware ordering)
SUSE Rancher distributions tracked under the SUSE bug report for this CVE
Downstream Kubernetes clusters managed by an affected Rancher Manager instance (availability impact)

Discovery Timeline

2026-08-05 - CVE-2026-59675 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-59675

Vulnerability Analysis

The flaw is an uncontrolled resource consumption issue [CWE-770] in the Rancher Manager HTTP handler chain. When API audit logging is active, an audit middleware invokes a copyReqBody routine that buffers the full request payload in memory to record it in the audit log. This buffering runs before APIBodyLimitingHandler can reject oversized requests.

Because the size cap is enforced downstream of the audit middleware, the 1 MiB default limit does not apply to bodies traversing the audit path. Login endpoints accept these requests without authentication, giving remote attackers a direct route to the vulnerable code.

A successful attack terminates the Rancher Manager process, taking the Rancher API and UI offline. Cluster workloads continue to run, but administrators lose the ability to manage, scale, or respond to incidents on downstream clusters until the control plane is restored.

Root Cause

The root cause is middleware ordering combined with missing input-size enforcement. The audit middleware calls copyReqBody and reads the request body without applying a maximum size. APIBodyLimitingHandler, which enforces the 1 MiB cap, is registered later in the chain and never executes for the buffered copy.

Attack Vector

The attack requires only network access to a public Rancher login endpoint. No credentials or user interaction are needed. An attacker issues HTTP POST requests with very large bodies to a login route. Each request forces the server to allocate memory proportional to the body size. Multiple concurrent connections quickly exhaust the available heap and trigger process termination.

See the GitHub Security Advisory GHSA-g4f6-44g4-23xm and the SUSE Bug Report CVE-2026-59675 for vendor technical details.

Detection Methods for CVE-2026-59675

Indicators of Compromise

Repeated POST requests to Rancher login endpoints with Content-Length values significantly exceeding 1 MiB from unauthenticated sources.
Rancher Manager process restarts, out-of-memory (OOM) kills, or Kubernetes pod evictions correlated with spikes in inbound request size.
Sudden growth in Rancher Manager resident memory (RSS) shortly after inbound traffic to /v3-public/* or other login routes.

Detection Strategies

Alert on HTTP request bodies larger than 1 MiB reaching Rancher login endpoints, as observed at the ingress controller or load balancer.
Correlate Rancher Manager container OOMKilled events with inbound request patterns from the same source IP range.
Monitor audit log write volume for abnormal growth that may reflect large buffered request payloads.

Monitoring Recommendations

Instrument the ingress layer to record Content-Length distributions per endpoint and flag outliers targeting /v3-public/ login paths.
Track Rancher Manager memory utilization, garbage collection pressure, and restart counts as availability signals for this class of attack.
Forward Rancher audit logs and Kubernetes control plane events to a centralized analytics pipeline to detect burst patterns from single sources.

How to Mitigate CVE-2026-59675

Immediate Actions Required

Upgrade Rancher Manager to the fixed release identified in GHSA-g4f6-44g4-23xm.
Restrict network exposure of the Rancher Manager UI and API to trusted networks or VPN clients where operationally feasible.
Place a reverse proxy or web application firewall in front of Rancher that enforces a request body size limit on login endpoints.

Patch Information

Refer to the vendor advisory GHSA-g4f6-44g4-23xm and the SUSE Bug Report CVE-2026-59675 for the fixed Rancher Manager versions and upgrade guidance. The fix restores correct enforcement so that the body-size cap applies to requests processed by the audit middleware.

Workarounds

Temporarily disable API audit logging on Rancher Manager until the patched version is deployed, which removes the vulnerable copyReqBody path.
Enforce a hard body-size limit (for example, 1 MiB) at the ingress or reverse proxy for /v3-public/* login endpoints.
Apply rate limiting and per-source connection limits at the ingress layer to reduce the impact of concurrent large-body requests.
Set memory and restart policies on the Rancher Manager workload so that OOM events recover quickly while a fix is being rolled out.

bash

# Example NGINX ingress annotation to cap login request body size
# Apply on the Ingress resource that fronts Rancher Manager
metadata:
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: "1m"
    nginx.ingress.kubernetes.io/limit-rps: "5"
    nginx.ingress.kubernetes.io/limit-connections: "10"