This is a middleware ordering vulnerability, not a missing limit. Rancher ships APIBodyLimitingHandler with a 1 MiB default, so the intuition that 'there's no body-size limit' is technically wrong. The flaw is that this handler runs after the audit middleware, which fully buffers the request body into heap memory before limiting can apply. The security control exists but is architecturally bypassed — an unauthenticated attacker hitting the login endpoint can send a request that the audit handler buffers entirely in memory, exhausting resources before the body limiter ever sees it. This is a single-packet DoS vector against a management plane that controls every downstream cluster.
The CVSS 7.5 rating is questionable. The exploit requires no authentication, targets universally exposed login endpoints, and can trivially exhaust memory with minimal concurrent connections. But the blast radius extends far beyond 'Rancher is down' — when the management plane collapses, centralized RBAC sync halts, GitOps pipelines fail, multi-cluster policy enforcement goes stale, and operators lose coordination across every managed cluster. This isn't a single service going down; it's the control surface for an entire fleet terminating. The availability impact metric in CVSS doesn't capture this topology multiplication.
For remediation, you have two paths. Reordering middleware so body limiting runs first is technically simple but dangerous if custom middleware or patched audit logs depend on specific chain positions — test thoroughly. Alternatively, enforce limits within the audit path itself by reading the body, checking size, and discarding if oversized while logging the violation. This preserves audit capability but re-introduces a small memory window, and the logging step itself may require re-parsing the body, creating a secondary bypass point. That's the architectural tension: audit logging needs body access before security filtering applies, and fixing the bypass may break audit fidelity.
Check whether disabling audit logging eliminates the attack surface — there may be other legacy code paths that buffer bodies before limiting applies. If you have audit logging enabled for compliance, you face an uncomfortable choice: disable it to remove the DoS vector, or accept the exposure while waiting for a fix that may compromise your audit chain. The vendor should provide explicit guidance on which trade-off applies to production environments.