# API Login failures

- Provider: [Harness](https://down.guide/providers/harness)
- Confidence: Confirmed
- Impact: Major outage
- lasted 21m
- started 2026-09-15 17:22 UTC
- Platform, Platform, Platform +1
- Harness states the impact was about 6m
- id: DWN-fd9123d11a
- Official page: https://stspg.io/ft7mmvv8qjn8

## Updates from Harness
### 2026-09-15 17:22 UTC: investigating
We are currently investigating this issue.

### 2026-09-15 17:35 UTC: identified
The issue has been identified and a fix is being implemented.

### 2026-09-15 17:43 UTC: monitoring
A fix has been implemented and we are monitoring the results.

### 2026-09-15 17:43 UTC: resolved
This incident has been resolved.

### 2026-09-29 00:11 UTC: postmortem
Root Cause Analysis Report
Brief API Login Failures Due to a Security Policy Misconfiguration
1. Executive Summary
On September 11, 2026, a change to one of our network security policies was deployed with a configuration error. For approximately 6 minutes, this caused login requests to be incorrectly blocked, preventing some users from logging in.
‌
The issue was detected automatically by our monitoring systems. The problematic change was fully reverted within 5 minutes of detection, restoring normal login functionality.
2. Impact
\* For approximately 6 minutes \\(12:30–12:36 PM CT on September 11, 2026\\), login requests matching certain URL paths were incorrectly blocked.
\* Any user attempting to log in during this window could have been affected
\* No other functionality was affected. Users already logged in prior to the window were not impacted.
3. Root Cause
As part of a planned security enhancement, our team implemented a new network security policy intended to block a small number of specific, exact URL paths. During implementation, the rule was configured with an erroneous matching condition instead of the intended exact-match condition.
‌
As a result, the policy blocked any request whose path began with those values, rather than only the exact paths intended , which included legitimate login requests that happened to share that prefix. This caused those login attempts to be rejected during the affected window.
4. Resolution
\* The problematic policy change was identified and fully reverted within 5 minutes of the first alert.
\* Normal login functionality was confirmed restored immediately following the revert.
5. Risk of Recurrence & Preventive Actions‌
\| Corrective / Preventive Action \|
\| --- \|
\| Enhanced our QA validation step in the process for this class of security policy change, so the deployed configuration is checked against its intended specification before go-live. \|
\| Enhanced automated test coverage that specifically validates exact-match versus prefix-match behavior for path-based rules, as an additional safeguard on top of the review process. \|

From the builder: does your app depend on Harness? [Sazabi](https://www.sazabi.com/?utm_source=down-guide&utm_medium=markdown&utm_content=harness) detects problems in your own logs without hand-written monitors, and you can ask it in plain language which errors mention Harness.

---
down.guide reads providers' official status pages every minute and adds its own evidence, always labeled. Free, no account. Agents: MCP at https://down.guide/mcp, REST at https://down.guide/api/v1, feeds at https://down.guide/feed. Built by [Sazabi](https://www.sazabi.com/?utm_source=down-guide&utm_medium=markdown&utm_content=DWN-fd9123d11a), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.