Rancher Unauthenticated DoS via TLS SAN Stuffing (CVE-2026-55996) Advisory

Vulnerability Overview Vulnerability Name: Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent CVE ID: CVE-2026-55996 CVSS v3 Base Metrics: Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low Severity: 4.3 / 10 Scope of Impact Affected Components: - on in downstream clusters - Rancher server on in upstream clusters Affected Versions: - - - - Vulnerability Description: - A denial-of-service vulnerability has been identified across multiple TLS listeners. The component uses the library to serve TLS traffic in both downstream clusters and on the Rancher server itself. Without a valid CN filter configuration, automatically appends every hostname from incoming TLS requests via Server Name Indication (SNI) to every served certificate. - An attacker with network access can send a large volume of TLS requests with different hostnames to the affected clusters, causing the served certificates to accumulate an unbounded number of Subject Alternative Names (SANs). Eventually, the certificates become so large that TLS handshakes fail, resulting in a denial of service due to message size limits. Remediation Patches: - on : When running in embedded MCM agent mode, the callback now returns , ignoring all dynamically generated SNI hostnames. Service certificates are restricted to their pre-configured static Subject Alternative Names, preventing any hostnames provided by an attacker from being appended. - Upstream Rancher server on : A Pod IP filter ( ) has been added, and a maximum SAN count of 30 has been set. The filter retains only entries corresponding to the IP addresses of currently running Rancher nodes, trimming out IPs from previous rolling updates and any attacker-injected IPs. Rancher versions containing the following fixes: - - - - Workarounds There is no complete workaround for users who cannot upgrade. As a partial mitigation, restrict access to the affected internal cluster endpoints by using Kubernetes resources to ensure that only trusted workloads can access: - pod IP on in downstream clusters - ClusterIP service on in upstream clusters This reduces the attack surface but does not fully eliminate the vulnerability. References GHSA-pd5j-vh5-wprg - Similar TLS SAN stuffing vulnerability in RKE2 via Additional Information If you have any questions or comments, please contact the SUSE Rancher Security Team. Open an issue in the Rancher repository. Verify your support matrix and product support lifecycles.

Goal Reached Thanks to every supporter — we hit 100%!

Rancher Unauthenticated DoS via TLS SAN Stuffing (CVE-2026-55996) Advisory

More from this source