CVE-2026-55997 Details
Description
Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, stored automation, or direct file access on a node, and could use it at any time to register a rogue node into the cluster.
A vulnerability exists in Rancher versions 2.14.0 prior to 2.14.4 and 2.13.0 prior to 2.13.8, where long-lived registration tokens are issued in plaintext to authenticate nodes and agents joining downstream clusters. These tokens, stored without expiration, can be accessed through the Rancher API, etcd, automation scripts, or direct file access on a node. Once obtained, a malicious user could use them to register rogue nodes, gaining full administrative control over the cluster.
To address this vulnerability, Rancher has implemented several measures in versions 2.14.4 and 2.13.8. These include storing registration tokens in Kubernetes Secrets, enhancing the install script's file permissions, and introducing automatic expiration and rotation of bootstrap tokens in version 2.15. For clusters already using a compromised token, it is recommended to delete the token, patch the cluster agent with a new one, and redeploy the agent.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55997 | [email protected] | |
| https://github.com/rancher/rancher/security/advisories/GHSA-7r53-jvhg-9jq4 | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-312 | Cleartext Storage of Sensitive Information | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |