EUVD-2026-53290Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Description explicitly states unauthenticated attacker, overriding PR:L in official vector; AV:N retained as TLS endpoints are network-accessible; A:L reflects listener-scoped DoS.
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent component running in downstream clusters and the Rancher server itself use the dynamiclistener library to serve TLS traffic. Without an effective CN filter configured, dynamiclistener automatically appended to each serving certificate any hostname presented via Server Name Indication (SNI) in incoming TLS requests.
An unauthenticated attacker with network access within the affected cluster could send a large number of TLS requests with distinct hostnames, causing the serving certificate to accumulate an unbounded number of Subject Alternative Names (SANs). Eventually, the certificate grows large enough that TLS handshakes fail with an excessive message size error, causing a denial of service on the affected listeners.
AnalysisAI
Denial of service in Rancher's dynamiclistener TLS library allows network-accessible attackers to exhaust certificate Subject Alternative Name capacity on both the Rancher server and cattle-cluster-agent components. By sending a large volume of TLS requests each presenting a distinct Server Name Indication (SNI) hostname, an attacker causes the dynamiclistener library to continuously append new SANs to the serving certificate until its size exceeds TLS handshake limits, breaking all TLS communication on the affected listener. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The exploitable condition is the absence of an effective CN filter in the dynamiclistener configuration, which the description implies is a non-default or misconfigured state ('Without an effective CN filter configured'). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) classifies this as Medium severity, reflecting limited impact (availability only, low) with no confidentiality or integrity consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to the Rancher server or a downstream cluster's cattle-cluster-agent TLS port writes a script that opens thousands of TLS connections, each advertising a different randomly generated hostname via the SNI extension. The dynamiclistener library automatically appends each unique hostname as a SAN to the serving certificate, causing it to grow until TLS handshakes from all clients - including legitimate Kubernetes management traffic - fail with an excessive message size error, effectively taking the Rancher management plane offline. … |
| Remediation | The primary remediation is to upgrade Rancher to a version containing a fixed dynamiclistener library that enforces an effective CN filter on SNI hostnames before appending them as SANs - consult the vendor advisory at https://github.com/rancher/rancher/security/advisories/GHSA-9jxv-832x-45q9 for the exact patched release version, which is not independently confirmed from the available input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role
A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network
Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. Rated critical severity (CVSS 9
A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by cr
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, a
Command injection in Rancher Manager’s cluster import endpoint enables remote attackers to deploy malicious containers o
SAML assertion replay in Rancher's Assertion Consumer Service (ACS) handler lets a person-in-the-middle who captures a v
Privilege escalation in SUSE Rancher (Kubernetes management platform) allows a user holding the Project Owner role to im
Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. Rated
Privilege escalation in Rancher 2.13 (before 2.13.6) and 2.14 (before 2.14.2) lets any authenticated user gain principal
Cleartext registration token exposure in Rancher allows a low-privileged user to obtain perpetually valid cluster join t
A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today