What is the CVSS score of CVE-2026-59675?

CVE-2026-59675 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Rancher Manager are affected by CVE-2026-59675?

Rancher Manager contains an unauthenticated denial-of-service vulnerability (CVSS 7.5) that crashes the management plane through unbounded memory allocation on public login endpoints, immediately…. A patch is available.

How to fix or mitigate CVE-2026-59675?

Within 24 hours: assess Rancher Manager deployments for exposure, disable API audit logging if operationally feasible, and implement rate limiting on public login endpoints (e.g., maximum 10 requests per minute per IP). Within 7 days: deploy WAF or reverse proxy rules to enforce strict request body size limits below 1 MiB, apply network-level access controls restricting Rancher API connectivity to trusted networks only, and validate mitigations in staging environments. Within 30 days: actively monitor Rancher security advisories and vendor communications for patch availability, establish an expedited change process for rapid patch deployment once released, and continuously review compensating control effectiveness through access logs and memory utilization metrics.

Rancher Manager CVE-2026-59675

EUVD-2026-53291 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-05 suse

Denial Of Service Rancher Suse

7.5

CVSS 3.1 · Vendor: suse

Severity by source

Vendor (suse) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable public login endpoint needs no auth; once audit logging is enabled, attack is trivial with no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

SUSE

HIGH

qualitative

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Aug 05, 2026 - 09:01 EUVD

Analysis Generated

Aug 05, 2026 - 08:36 vuln.today

CVE Published

Aug 05, 2026 - 07:49 cve.org

HIGH 7.5

DescriptionCVE.org

When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap (default 1 MiB) is bypassed for requests that pass through the audit copyReqBody path. An unauthenticated attacker can send arbitrarily large request bodies to the public login endpoints, causing the Rancher Manager server process to allocate memory proportional to the supplied body size. With just a few concurrent connections, this can exhaust available memory and terminate the Rancher Manager plane process, making the Rancher API and UI unavailable and interrupting management of all downstream clusters.

AnalysisAI

Unbounded memory allocation in Rancher Manager's API audit logging middleware enables unauthenticated remote attackers to crash the Rancher management plane via memory exhaustion. When API audit logging is enabled, the audit copyReqBody middleware - positioned ahead of Rancher's APIBodyLimitingHandler in the handler chain - reads entire HTTP request bodies into memory on public login endpoints with no size cap, bypassing the default 1 MiB limit. An attacker sending a small number of concurrent oversized requests to these endpoints can exhaust server memory and terminate the Rancher Manager process, rendering the Rancher API and UI unavailable and severing management control of all downstream Kubernetes clusters. No public exploit has been identified at time of analysis.

Technical ContextAI

Rancher Manager (cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*) is SUSE's Kubernetes multi-cluster management platform. The vulnerability is rooted in CWE-770 - Allocation of Resources Without Limits or Throttling. Go HTTP servers allocate heap memory proportional to request body size when reading into a buffer; without a size cap, this is bounded only by available system RAM. The audit logging middleware intercepts requests to capture them for compliance logs, but was placed earlier in the middleware chain than the APIBodyLimitingHandler which enforces the 1 MiB body size policy. Because Go's middleware/handler chains are additive and order-dependent, any request that reaches the audit copyReqBody function before APIBodyLimitingHandler can trigger uncapped allocation. The vulnerability is specific to the login endpoints because those are the paths where the audit middleware is active and which are publicly reachable without prior authentication.

RemediationAI

Consult the vendor advisory at https://github.com/rancher/rancher/security/advisories/GHSA-g4f6-44g4-23xm for the patched release version - no exact fixed version number was included in the available data, so an upstream fix via PR or commit may be pending a tagged release. Until a patch is applied, the most effective compensating control is to disable API audit logging if it is not operationally required, which eliminates the vulnerable code path entirely. If audit logging must remain enabled, deploy a reverse proxy or WAF in front of Rancher's API endpoint configured to enforce a strict request body size limit (e.g., 1 MiB) on login endpoints - this mirrors the intent of the bypassed APIBodyLimitingHandler. Additionally, rate-limiting concurrent connections per source IP to Rancher's login endpoints will raise the cost of the attack. Note that disabling audit logging may affect compliance posture in regulated environments, and WAF-based body limits require careful tuning to avoid breaking legitimate large-body requests to other endpoints.