CVE-2026-59675 Details
Description
When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap (default 1 MiB) is bypassed for requests that pass through the audit copyReqBody path. An unauthenticated attacker can send arbitrarily large request bodies to the public login endpoints, causing the Rancher Manager server process to allocate memory proportional to the supplied body size. With just a few concurrent connections, this can exhaust available memory and terminate the Rancher Manager plane process, making the Rancher API and UI unavailable and interrupting management of all downstream clusters.
A denial-of-service vulnerability has been identified in Rancher's API audit-log middleware. When audit logging is enabled, the middleware reads the entire HTTP request body into memory without a size limit on login endpoints. This unbounded memory allocation can be exploited by an unauthenticated attacker who sends large request bodies to public login endpoints. The vulnerability bypasses Rancher's default 1 MiB body-size cap, leading to memory exhaustion that can terminate the Rancher Manager process. This disruption makes the Rancher API and UI unavailable, interrupting management of all downstream clusters.
Users can upgrade to Rancher versions 2.14.4, 2.13.8, or 2.12.12, where this vulnerability has been patched. The fix involves capping the request body size in the audit middleware for login endpoints, preventing unbounded memory allocation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-59675 | [email protected] | |
| https://github.com/rancher/rancher/security/advisories/GHSA-g4f6-44g4-23xm | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |