# Harness: Critical incident: API Login failures

**Summary:** _summary pending_
- Kind: Major incident · Label: critical (vendor)
- Changed: 2026-09-15 17:22 UTC · Detected: 2026-10-19 17:33 UTC
- [Source: https://stspg.io/ft7mmvv8qjn8](https://stspg.io/ft7mmvv8qjn8)
- [Company: Harness](https://rewindex.com/company/harness.md)
- Versions: before (none: first archived) → after incident\_version:695/vnjt1dx2wvjc@00b22f37af56
- Change 1 of 1 for this incident

Incident page (full timeline): [API Login failures](https://rewindex.com/company/harness/incidents/vnjt1dx2wvjc.md)
## What changed

**1. Added: Title**

```diff
+ API Login failures
```

**2. Added: Impact**

```diff
+ critical
```

**3. Added: Status**

```diff
+ postmortem
```

**4. Added: Start time**

```diff
+ 2026-09-15 17:22 UTC
```

**5. Added: Resolved time**

```diff
+ 2026-09-15 17:43 UTC
```

**6. Added: Affected components**

```diff
+ Platform, Prod 1 - Platform, Prod 2 - Platform, Prod 3 - Platform, Prod 4 - Platform
```

**7. Added: Update** (investigating) · 2026-09-15 17:22 UTC

```diff
+ We are currently investigating this issue.
```

**8. Added: Update** (identified) · 2026-09-15 17:35 UTC

```diff
+ The issue has been identified and a fix is being implemented.
```

**9. Added: Update** (monitoring) · 2026-09-15 17:43 UTC

```diff
+ A fix has been implemented and we are monitoring the results.
```

**10. Added: Update** (resolved) · 2026-09-15 17:43 UTC

```diff
+ This incident has been resolved.
```

**11. Added: Update** (postmortem) · 2026-09-29 00:11 UTC

```diff
+ # Root Cause Analysis Report ## Brief API Login Failures Due to a Security Policy Misconfiguration ## 1. Executive Summary On September 11, 2026, a change to one of our network security policies was deployed with a configuration error. For approximately 6 minutes, this caused login requests to be incorrectly blocked, preventing some users from logging in. ‌ The issue was detected automatically by our monitoring systems. The problematic change was fully reverted within 5 minutes of detection, restoring normal login functionality. # 2. Impact * For approximately 6 minutes \(12:30–12:36 PM CT on September 11, 2026\), login requests matching certain URL paths were incorrectly blocked. * Any user attempting to log in during this window could have been affected * No other functionality was affected. Users already logged in prior to the window were not impacted. # 3. Root Cause As part of a planned security enhancement, our team implemented a new network security policy intended to block a small number of specific, exact URL paths. During implementation, the rule was configured with an erroneous matching condition instead of the intended exact-match condition. ‌ As a result, the policy blocked any request whose path began with those values, rather than only the exact paths intended ,  which included legitimate login requests that happened to share that prefix. This caused those login attempts to be rejected during the affected window. # 4. Resolution * The problematic policy change was identified and fully reverted within 5 minutes of the first alert. * Normal login functionality was confirmed restored immediately following the revert. # 5. Risk of Recurrence & Preventive Actions‌ | **Corrective / Preventive Action** | | --- | | Enhanced our QA validation step in the process for this class of security policy change, so the deployed configuration is checked against its intended specification before go-live. | | Enhanced automated test coverage that specifically validates exact-match versus prefix-match behavior for path-based rules, as an additional safeguard on top of the review process. |
```

## History of this incident

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2026-09-15 17:22 UTC | Critical incident: API Login failures (this change) | critical |

All Harness changes: [timeline](https://rewindex.com/company/harness/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._


---
Canonical: https://rewindex.com/change/ic1331f6ce94691 · Markdown: https://rewindex.com/change/ic1331f6ce94691.md · JSON: https://rewindex.com/api/v1/changes/ic1331f6ce94691 · Generated 2026-10-19T23:13:38.133Z