CVE-2026-55997

HighCVSS 8.8/10Last modified Sep 1, 2026

Description

Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, stored automation, or direct file access on a node, and could use it at any time to register a rogue node into the cluster.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-312

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
rancher	rancher	>= 2.14.0, < 2.14.4; >= 2.13.0, < 2.13.8

References

Timeline

Published: Aug 5, 2026
Last modified: Sep 1, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-559985.3The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID reference CVE-2026-559997.8Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could CVE-2026-56004.3A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-CVE-2026-560007.8Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could CVE-2026-560018.8A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to a CVE-2026-560028.8A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X clien CVE-2026-560038.8A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() bef CVE-2026-5600410.0A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to pr CVE-2026-560057.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-CVE-2026-560067.1Unauthenticated Cross Site Scripting (XSS) in H5P <= 1.17.6 versions.CVE-2026-560075.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP Ocean Product Sharing allows S CVE-2026-560088.8Contributor Privilege Escalation in Fusion Builder <= 3.15.4 versions.