8.8
Élevée
CVE-2026-55997 Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster
Description
Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, stored automation, or direct file access on a node, and could use it at any time to register a rogue node into the cluster.
Produits et versions touchés
Autres CVE de Rancher
Les 7 CVE de Rancher →
CVE-2023-32196
A vulnerability has been identified whereby privilege escalation checks are not properly enforced for…
6.6
Moyenne
CVE-2023-32194
A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces"; no…
7.2
Élevée
CVE-2023-22649
A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs
8.4
Élevée
CVE-2021-31999
A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as…
8.8
Élevée