Read the docs
TI-2026-40392 Aliases CVE-2026-55997

Long-lived Rancher registration token exposed in plaintext

Priority LOW 39CWE-312Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-312.

Summary

Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, stored automation, or direct file access on a node, and could use it at any time to register a rogue node into the cluster.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00112 1st percentileScored 2026-11-07
Fix Fixed rancher (rancher): 2.14.4, 2.13.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Rancherrancher2.14.0 to before 2.14.4; 2.13.0 to before 2.13.82.14.4, 2.13.8Patch availableCNA
  • rancher VendorRancher Affected 2.14.0 to before 2.14.4; 2.13.0 to before 2.13.8 Fixed in 2.14.4, 2.13.8 Patch available CNA

Remediation

  • Fix · CNA rancher (rancher) Fixed in 2.14.4, 2.13.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55997

References

Other 2

  • TI-2021-07559 Rancher: Cloud credentials can be used through proxy API by users without access CVSS 3.1CRITICAL 9.9
  • TI-2026-32455 Local Path Provisioner: HelperPod Template Injection CVSS 3.1HIGH 8.7
  • TI-2021-14897 Steve API proxy impersonation CVSS 3.1HIGH 8.8
  • TI-2021-14896 Deleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindings CVSS 3.1HIGH 8.8
  • TI-2021-11979 Rancher: Privilege escalation vulnerability via malicious Connection header CVSS 3.1HIGH 8.8
  • TI-2021-07557 rancher: API group not properly specified when creating Kubernetes RBAC resources CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences