Rancher up to 2.11.15/2.12.11/2.13.7/2.14.3 cattle-cluster-agent denial of service

Summaryinfo

A vulnerability, which was classified as critical, was found in Rancher up to 2.11.15/2.12.11/2.13.7/2.14.3. This vulnerability affects unknown code of the component cattle-cluster-agent. The manipulation results in denial of service. This vulnerability is identified as CVE-2026-55996. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical has been found in Rancher up to 2.11.15/2.12.11/2.13.7/2.14.3. Affected is some unknown functionality of the component cattle-cluster-agent. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability. CVE summarizes:

A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent component running in downstream clusters and the Rancher server itself use the dynamiclistener library to serve TLS traffic. Without an effective CN filter configured, dynamiclistener automatically appended to each serving certificate any hostname presented via Server Name Indication (SNI) in incoming TLS requests. An unauthenticated attacker with network access within the affected cluster could send a large number of TLS requests with distinct hostnames, causing the serving certificate to accumulate an unbounded number of Subject Alternative Names (SANs). Eventually, the certificate grows large enough that TLS handshakes fail with an excessive message size error, causing a denial of service on the affected listeners.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-55996 since 06/18/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 2.11.16, 2.12.12, 2.13.8 or 2.14.4 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Rancher

Version

• 2.11.0
• 2.11.1
• 2.11.2
• 2.11.3
• 2.11.4
• 2.11.5
• 2.11.6
• 2.11.7
• 2.11.8
• 2.11.9
• 2.11.10
• 2.11.11
• 2.11.12
• 2.11.13
• 2.11.14
• 2.11.15
• 2.12.0
• 2.12.1
• 2.12.2
• 2.12.3
• 2.12.4
• 2.12.5
• 2.12.6
• 2.12.7
• 2.12.8
• 2.12.9
• 2.12.10
• 2.12.11
• 2.13.0
• 2.13.1
• 2.13.2
• 2.13.3
• 2.13.4
• 2.13.5
• 2.13.6
• 2.13.7
• 2.14.0
• 2.14.1
• 2.14.2
• 2.14.3

Website

• Product: https://github.com/rancher/rancher/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion