The vulnerability lies in the audit middleware, which arbitrarily reads the entire HTTP request body into memory when audit logging is enabled. The middleware bypasses the API body limiting handler, allowing request bodies larger than the default 1 MiB cap to be processed on login endpoints. An unauthenticated attacker can exploit this by sending excessively large request bodies, causing the Rancher Manager process to allocate proportionally large amounts of memory. With only a few concurrent connections the process can run out of memory, crash, and make the Rancher API and UI unavailable, disrupting management of all downstream clusters. The weakness is identified as memory allocation without consideration of size limits (CWE‑770).

SUSE Rancher Manager instances are affected. No explicit product version information is disclosed in the advisory, so any installation running the audit middleware without size restrictions on the login endpoints is potentially vulnerable.

The CVSS score of 7.5 classifies this vulnerability as high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. The attack vector is unauthenticated and requires only the public login endpoints to be reachable; no additional privileges or authentication are needed. An adversary can craft a few large requests to deplete memory, trigger a process crash, and trigger a denial of service. Because the vulnerability affects the core Rancher Manager process, the impact spans the entire Rancher control plane and all clusters managed through it.