EUVD-2026-53291Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable public login endpoint needs no auth; once audit logging is enabled, attack is trivial with no confidentiality or integrity impact.
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap (default 1 MiB) is bypassed for requests that pass through the audit copyReqBody path. An unauthenticated attacker can send arbitrarily large request bodies to the public login endpoints, causing the Rancher Manager server process to allocate memory proportional to the supplied body size. With just a few concurrent connections, this can exhaust available memory and terminate the Rancher Manager plane process, making the Rancher API and UI unavailable and interrupting management of all downstream clusters.
AnalysisAI
Unbounded memory allocation in Rancher Manager's API audit logging middleware enables unauthenticated remote attackers to crash the Rancher management plane via memory exhaustion. When API audit logging is enabled, the audit copyReqBody middleware - positioned ahead of Rancher's APIBodyLimitingHandler in the handler chain - reads entire HTTP request bodies into memory on public login endpoints with no size cap, bypassing the default 1 MiB limit. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | API audit logging must be explicitly enabled in the Rancher configuration - this is a non-default setting. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the worst-case scenario: no authentication is required, the attack is network-accessible, and the availability impact is high. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker discovers that a target Rancher instance has API audit logging enabled (detectable by observing response behavior or through prior reconnaissance). The attacker opens several concurrent HTTP POST connections to the Rancher login endpoint, each sending a multi-gigabyte request body. … |
| Remediation | Consult the vendor advisory at https://github.com/rancher/rancher/security/advisories/GHSA-g4f6-44g4-23xm for the patched release version - no exact fixed version number was included in the available data, so an upstream fix via PR or commit may be pending a tagged release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: assess Rancher Manager deployments for exposure, disable API audit logging if operationally feasible, and implement rate limiting on public login endpoints (e.g., maximum 10 requests per minute per IP). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role
A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network
Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. Rated critical severity (CVSS 9
A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by cr
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, a
Command injection in Rancher Manager’s cluster import endpoint enables remote attackers to deploy malicious containers o
SAML assertion replay in Rancher's Assertion Consumer Service (ACS) handler lets a person-in-the-middle who captures a v
Privilege escalation in SUSE Rancher (Kubernetes management platform) allows a user holding the Project Owner role to im
Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. Rated
Privilege escalation in Rancher 2.13 (before 2.13.6) and 2.14 (before 2.14.2) lets any authenticated user gain principal
Cleartext registration token exposure in Rancher allows a low-privileged user to obtain perpetually valid cluster join t
A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today