CVE-2026-55997
Description
Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, stored automation, or direct file access on a node, and could use it at any time to register a rogue node into the cluster.
Summary dbcve.org
Rancher stores long-lived node/agent registration tokens in plaintext with no expiration. Attackers with access to the Rancher API, etcd, stored automation, or node file systems can retrieve these tokens and use them at any time to register unauthorized (rogue) nodes into downstream clusters.
Mitigation
Implement token expiration/rotation and encrypt tokens at rest. Audit and revoke existing plaintext tokens, then enforce time-limited tokens with automatic rotation for all future node registrations.