EUVD-2026-53290Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Description explicitly states unauthenticated attacker, overriding PR:L in official vector; AV:N retained as TLS endpoints are network-accessible; A:L reflects listener-scoped DoS.
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
Lifecycle Timeline
2DescriptionCVE.org
A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent component running in downstream clusters and the Rancher server itself use the dynamiclistener library to serve TLS traffic. Without an effective CN filter configured, dynamiclistener automatically appended to each serving certificate any hostname presented via Server Name Indication (SNI) in incoming TLS requests.
An unauthenticated attacker with network access within the affected cluster could send a large number of TLS requests with distinct hostnames, causing the serving certificate to accumulate an unbounded number of Subject Alternative Names (SANs). Eventually, the certificate grows large enough that TLS handshakes fail with an excessive message size error, causing a denial of service on the affected listeners.
AnalysisAI
Denial of service in Rancher's dynamiclistener TLS library allows network-accessible attackers to exhaust certificate Subject Alternative Name capacity on both the Rancher server and cattle-cluster-agent components. By sending a large volume of TLS requests each presenting a distinct Server Name Indication (SNI) hostname, an attacker causes the dynamiclistener library to continuously append new SANs to the serving certificate until its size exceeds TLS handshake limits, breaking all TLS communication on the affected listener. No public exploit has been identified at time of analysis, and CISA KEV status is not confirmed; however, exploitation is straightforward given the low technical barrier.
Technical ContextAI
Rancher's dynamiclistener library handles dynamic TLS certificate issuance for the Rancher management server and its downstream cattle-cluster-agent components, which run inside managed Kubernetes clusters. The library's design permits automatic inclusion of hostnames presented via Server Name Indication (SNI) - a TLS extension that allows clients to declare which host they are attempting to reach before the handshake completes - directly as Subject Alternative Names (SANs) in the serving certificate. Without a Common Name (CN) filter to validate or restrict which SNI values are accepted, the library appends every unique SNI it encounters to the live certificate. TLS certificates with excessively large SAN sets eventually exceed the maximum TLS record size (typically governed by RFC 5246 limits), causing the handshake to fail with an 'excessive message size' error. The affected CPE is cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* (all versions). CWE was not assigned by the reporter, but the root cause maps conceptually to CWE-400 (Uncontrolled Resource Consumption) through unbounded certificate state accumulation driven by external input.
RemediationAI
The primary remediation is to upgrade Rancher to a version containing a fixed dynamiclistener library that enforces an effective CN filter on SNI hostnames before appending them as SANs - consult the vendor advisory at https://github.com/rancher/rancher/security/advisories/GHSA-9jxv-832x-45q9 for the exact patched release version, which is not independently confirmed from the available input data. As a compensating control, restrict network access to Rancher server TLS listeners and cattle-cluster-agent endpoints to trusted source IP ranges using network policies or firewall rules, reducing the attacker's ability to send high volumes of crafted TLS requests; note this does not fix the root cause and limits operational flexibility. If the dynamiclistener CN filter is configurable independently of upgrading, enabling it immediately constitutes the most targeted workaround - review Rancher documentation for the relevant configuration parameter. Monitor TLS certificate SAN count as an operational metric to detect early-stage exploitation.
An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role
A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network
Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. Rated critical severity (CVSS 9
A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by cr
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, a
Stored cross-site scripting in the SUSE Rancher UI allows unauthenticated remote attackers to inject malicious script th
Command injection in Rancher Manager’s cluster import endpoint enables remote attackers to deploy malicious containers o
SAML assertion replay in Rancher's Assertion Consumer Service (ACS) handler lets a person-in-the-middle who captures a v
Privilege escalation in SUSE Rancher (Kubernetes management platform) allows a user holding the Project Owner role to im
Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. Rated
Privilege escalation in Rancher 2.13 (before 2.13.6) and 2.14 (before 2.14.2) lets any authenticated user gain principal
Privilege escalation in SUSE Rancher Fleet (0.14.x before 0.14.11, 0.15.x before 0.15.7, and 0.16.x before 0.16.2) lets
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today