Rancher Long-lived Registration Token Exposure in Plaintext Fix Guide (CVE-2026-55997)

Vulnerability Overview Vulnerability Name: Long-lived Rancher registration token exposed in plaintext CVE ID: CVE-2026-55997 Severity: High (8.8 / 10) Description: Rancher issues long-lived registration tokens when registering nodes and agents with downstream clusters via the Rancher API. These tokens are stored in plaintext and have no expiration time. Attackers can obtain these tokens via the Rancher API, etcd, stored configuration files, or direct file access, and use them to register malicious nodes or agents. Affected Versions Affected Versions: - >=v2.14.0, =v2.13.0, <v2.13.8 Fixed Versions: - v2.14.4 - v2.13.8 Remediation 1. Secret-based token storage: CRT tokens are now stored in Kubernetes Secrets instead of the CRD's field. 2. API compatibility shims: Norman and Steve API shims have replaced the legacy behavior for retrieving CRT tokens from Secrets. 3. Opt-in TTL-based token rotation: TTL-based token rotation functionality has been introduced. It is disabled by default but can be enabled via CRD configuration. 4. RBAC for Secret access: A new role has been created to restrict access to Secrets. 5. Install script permission hardening: The permissions of the install script have been changed from 9644 to 9698 to prevent non-privileged local users from reading them. 6. Bootstrap token TTL invalidation: System agent bootstrap tokens now automatically expire after the first connection, with a short TTL of 30 seconds and a long TTL of 30 minutes. Mitigations Manually restrict install script permissions: Execute on each pre-provisioned node. Restrict local access to downstream nodes: Avoid running untrusted workloads in locations such as . Restrict access to the token exposure surface: Limit access to etcd backups, Infrastructure as Code repositories, CI/CD configurations, and shell history. Rotate compromised tokens: If a specific is known or suspected to be compromised, force the generation of a new token and restart the agent. Additional Information For questions or comments, contact the SUSE Rancher Security Team. Open an issue in the Rancher repository. Verify the support matrix and product support lifecycle. POC Code No specific POC code or exploit code is included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

Rancher Long-lived Registration Token Exposure in Plaintext Fix Guide (CVE-2026-55997)

More from this source