What is the CVSS score of EUVD-2026-53259?

EUVD-2026-53259 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Rancher are affected by EUVD-2026-53259?

Cleartext storage of cluster enrollment tokens in Rancher enables low-privileged users to obtain perpetually valid credentials for unauthorized node enrollment into production Kubernetes clusters.. A patch is available.

How to fix or mitigate EUVD-2026-53259?

Within 24 hours, inventory all Rancher instances and cluster enrollment activities, implement strict API-level access controls to token endpoints, and enable enhanced logging of cluster join requests. Within 7 days, audit node membership across all downstream clusters against your authoritative inventory, isolate etcd and automation artifact storage from unnecessary access paths, and enforce network segmentation between Rancher management planes and enrolled clusters. Within 30 days, deploy token encryption at rest where your architecture permits, implement token expiration and rotation policies through custom automation, and establish an upgrade timeline with your Rancher vendor for permanent remediation once patches become available.

Rancher EUVD-2026-53259

| CVE-2026-55997 HIGH

Cleartext Storage of Sensitive Information (CWE-312)

2026-08-05 suse

Information Disclosure Rancher

8.8

CVSS 3.1 · Vendor: suse

Severity by source

Vendor (suse) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

AV:N chosen because the Rancher API is an explicit network-accessible exposure vector requiring only low privileges to read tokens.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 05, 2026 - 09:01 EUVD

Analysis Generated

Aug 05, 2026 - 08:37 vuln.today

CVE Published

Aug 05, 2026 - 07:53 cve.org

HIGH 8.8

DescriptionCVE.org

Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, stored automation, or direct file access on a node, and could use it at any time to register a rogue node into the cluster.

AnalysisAI

Cleartext registration token exposure in Rancher allows a low-privileged user to obtain perpetually valid cluster join tokens and enlist rogue nodes into downstream Kubernetes clusters. The tokens - used to authenticate nodes and agents during cluster bootstrapping - are stored without encryption or expiration and are reachable through at least four distinct channels: the Rancher API, etcd, stored automation artifacts, and direct filesystem access on enrolled nodes. The CVSS scope-change flag (S:C) accurately reflects that successful exploitation extends attacker influence beyond the Rancher management plane into downstream cluster workloads, secrets, and compute. No public exploit has been identified at time of analysis, and no CISA KEV listing exists.

Technical ContextAI

Rancher (cpe:2.3:a:rancher:rancher:*:*:*:*:*:*:*:*) is a multi-cluster Kubernetes management platform that issues bootstrap registration tokens to authenticate new nodes and agents joining downstream clusters. These tokens are Kubernetes Secret or API objects stored in etcd - the distributed key-value store backing the Kubernetes control plane. CWE-312 (Cleartext Storage of Sensitive Information) is the root cause: secrets with long or indefinite lifetimes are persisted in a readable form rather than being encrypted at rest, hashed, or time-limited. The combination of no expiration and plaintext storage means any credential leaked once remains exploitable indefinitely, and the broad set of access paths (API, etcd, automation scripts, node files) dramatically widens the effective attack surface beyond a single privilege boundary.

RemediationAI

Consult the vendor advisory at https://github.com/rancher/rancher/security/advisories/GHSA-7r53-jvhg-9jq4 for the patched release version, which was not independently confirmed in the available input data. Upon patching, proactively rotate all existing registration tokens - simply upgrading Rancher does not invalidate tokens already issued and stored in etcd or automation scripts. Audit all locations where tokens may have been cached: CI/CD pipeline secrets, GitOps repositories, node cloud-init scripts, and infrastructure-as-code templates. Restrict access to the Rancher API to only authorized management networks using network policies or API gateway ACLs; this reduces the API-based token exposure path but does not address etcd or filesystem paths. Enable etcd encryption at rest if not already configured, as this limits the etcd exposure vector. Restrict direct shell access on enrolled nodes to reduce the filesystem exposure path. Note that network restrictions are compensating controls, not substitutes for patching and token rotation.