CVE-2026-55997

Published: Aug 5, 2026Modified: Sep 1, 2026

8.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 2.0 / Impact: 6.0

Source: meissner@suse.de (Secondary)

Description

Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, stored automation, or direct file access on a node, and could use it at any time to register a rogue node into the cluster.

Related CWEs

CWE-312

Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References (2)

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55997

Source: meissner@suse.de

https://github.com/rancher/rancher/security/advisories/GHSA-7r53-jvhg-9jq4

Source: meissner@suse.de

Timeline

No history available yet.