VULNERABILITY INTELLIGENCE
CVE-2026-55997
CVSS score8.8 HIGH
EPSS probability0.11%
CISA KEVNot currently listed
Published2026-08-05
Last modified2026-09-01
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Description
Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, stored automation, or direct file access on a node, and could use it at any time to register a rogue node into the cluster.
Weakness classification
- meissner@suse.de: CWE-312