CVE-2026-55997: Rancher Auth Bypass Vulnerability

CVE-2026-55997 Overview

Rancher issues long-lived registration tokens that authenticate nodes and agents joining a downstream cluster. The tokens are stored in plaintext with no expiration, creating a cleartext storage of sensitive information weakness [CWE-312]. An authenticated local user can retrieve a token through the Rancher API, etcd, stored automation, or direct file access on a node. The attacker can then use the token at any time to register a rogue node into the cluster and gain high-impact control over confidentiality, integrity, and availability.

Critical Impact
A leaked registration token allows an attacker to join a rogue node to a downstream Kubernetes cluster and pivot into workloads managed by Rancher.

Affected Products

Rancher (SUSE) — see vendor advisory for affected version ranges
Downstream Kubernetes clusters provisioned or managed by Rancher
Nodes and agents that consume Rancher registration tokens

Discovery Timeline

2026-08-05 - CVE-2026-55997 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-55997

Vulnerability Analysis

Rancher uses registration tokens as the shared secret that authenticates new nodes and agents joining a downstream cluster. The tokens are issued with no expiration and remain valid indefinitely once created. Rancher persists these tokens in cleartext across multiple storage locations, including the Rancher API, the backing etcd datastore, automation systems that provision nodes, and configuration files on the nodes themselves.

Any principal with read access to one of those storage locations can retrieve a working token. Because the token does not rotate and does not expire, revocation is difficult and the exposure window is effectively unbounded. An attacker who obtains a token can invoke the node registration workflow and attach an attacker-controlled host as a legitimate cluster member.

Once a rogue node joins, it can host malicious workloads, receive scheduled pods, and access cluster secrets and service account tokens available to those workloads. The condition maps to CWE-312: Cleartext Storage of Sensitive Information.

Root Cause

Rancher stores registration tokens in plaintext and issues them without an expiration attribute. There is no rotation lifecycle and no scoping that limits how many times a token can be used to enroll a node.

Attack Vector

Exploitation requires local access with low privileges to a location where tokens are stored, such as a management node, an etcd backup, or an automation system holding cluster provisioning data. The attacker reads the plaintext token and replays it against the Rancher node registration endpoint. Successful registration causes a scope change from the compromised read context to the downstream cluster runtime.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-7r53-jvhg-9jq4 for vendor technical details.

Detection Methods for CVE-2026-55997

Indicators of Compromise

Unexpected node objects appearing in a downstream cluster, especially with hostnames or IP ranges outside the approved provisioning inventory.
Rancher audit log entries showing node registration API calls from source addresses that do not match known automation or bastion hosts.
Access to etcd snapshots, Rancher configuration files, or automation secret stores by accounts that do not normally read those objects.
Reuse of the same registration token from multiple distinct source addresses over time.

Detection Strategies

Alert on any new node join event and correlate the source IP and cluster identifier against an allowlist of provisioning systems.
Monitor Rancher API access logs for GET operations against registration token endpoints performed by non-service accounts.
Baseline read access to etcd and Rancher management filesystem paths, and flag deviations for review.

Monitoring Recommendations

Forward Rancher audit logs and Kubernetes API server audit logs to a central analytics platform for correlation and long-term retention.
Track the population of active registration tokens per cluster and alert when tokens exceed a defined age threshold.
Inventory every host that holds a copy of a registration token, including CI/CD runners and configuration management servers.

How to Mitigate CVE-2026-55997

Immediate Actions Required

Apply the Rancher security update referenced in GHSA-7r53-jvhg-9jq4 as soon as a fixed release is available for your channel.
Rotate all existing registration tokens for every managed downstream cluster and invalidate any prior tokens.
Audit etcd, backup archives, automation repositories, and node filesystems for stored plaintext tokens and purge unnecessary copies.
Review the current node inventory of each downstream cluster and remove any node that cannot be tied to an approved provisioning event.

Patch Information

Refer to the SUSE Bugzilla entry for CVE-2026-55997 and the Rancher GitHub Security Advisory GHSA-7r53-jvhg-9jq4 for fixed version information and upgrade guidance.

Workarounds

Restrict read access to Rancher management APIs, etcd, and node configuration paths to the smallest set of operators and service accounts required.
Store registration tokens only in a secrets manager with short-lived leases, and remove them from node disks and automation history once bootstrap completes.
Enforce network segmentation so that only approved provisioning networks can reach the Rancher node registration endpoint.
Regenerate registration tokens on a scheduled cadence until the fixed release is deployed.

bash

# Configuration example: rotate a Rancher cluster registration token via kubectl
# Delete the existing token object so Rancher regenerates a fresh one
kubectl -n cattle-system delete clusterregistrationtoken default-token --ignore-not-found

# Restrict read access on the management cluster to reduce token exposure
kubectl -n cattle-system create rolebinding restrict-token-readers \
  --clusterrole=view \
  --group=platform-admins