CVE-2026-59675

Name of the Vulnerable Software and Affected Versions Rancher Manager (affected versions not specified)

Description When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. This occurs because the audit middleware is positioned before the APIBodyLimitingHandler in the handler chain, bypassing the default 1 MiB body-size cap for requests using the copyReqBody path. An unauthenticated attacker can send excessively large request bodies to public login endpoints, forcing the server to allocate memory proportional to the body size. A small number of concurrent connections can exhaust available memory, terminating the server process and rendering the API and UI unavailable, which interrupts the management of all downstream clusters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.