CVE-2026-55997

Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, stored automation, or direct file access on a node, and could use it at any time to register a rogue node into the cluster.

Score

CVSS 3.1 8.8 High

Status

Awaiting Analysis - meissner@suse.de

Published

2026-08-05

Last modified

2026-08-06

Weaknesses

CWE-312

Affected products

• Rancher (Rancher)

References

• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55997
• https://github.com/rancher/rancher/security/advisories/GHSA-7r53-jvhg-9jq4