CVE-2026-59675: Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service
When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap (default 1 MiB) is bypassed for requests that pass through the audit copyReqBody path. An unauthenticated attacker can send arbitrarily large request bodies to the public login endpoints, causing the Rancher Manager server process to allocate memory proportional to the supplied body size. With just a few concurrent connections, this can exhaust available memory and terminate the Rancher Manager plane process, making the Rancher API and UI unavailable and interrupting management of all downstream clusters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
When API audit logging is enabled, ensure the audit middleware’s copyReqBody path applies a request body size limit to public login endpoints so arbitrarily large request bodies cannot bypass the Rancher APIBodyLimitingHandler cap (default 1 MiB).
Rancher Manager (API audit-log middleware) Request body size limiting for public login endpoints (audit copyReqBody path) = Enforce the same body-size cap as Rancher's APIBodyLimitingHandler (default 1 MiB) - Compensating control
Mitigate availability impact by restricting/metering access to the Rancher Manager public login endpoints (e.g., via a WAF or network/ACL rate limiting) to reduce concurrent requests that attempt to send arbitrarily large bodies.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59675?
The severity of CVE-2026-59675 is high with a score of 7.5.
What does CVE-2026-59675 impact?
CVE-2026-59675 impacts Rancher's audit logging functionality, leading to a potential denial of service through memory exhaustion.
How do I fix CVE-2026-59675?
To fix CVE-2026-59675, ensure API audit logging is disabled or implement request body size enforcement to prevent memory exhaustion.
What causes CVE-2026-59675?
CVE-2026-59675 is caused by the audit-log middleware reading the entire HTTP request body without a size limit on login endpoints.
Is CVE-2026-59675 exploitable remotely?
Yes, CVE-2026-59675 is exploitable remotely due to its unauthenticated nature.