EUVD-2026-53259Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
AV:N chosen because the Rancher API is an explicit network-accessible exposure vector requiring only low privileges to read tokens.
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, stored automation, or direct file access on a node, and could use it at any time to register a rogue node into the cluster.
AnalysisAI
Cleartext registration token exposure in Rancher allows a low-privileged user to obtain perpetually valid cluster join tokens and enlist rogue nodes into downstream Kubernetes clusters. The tokens - used to authenticate nodes and agents during cluster bootstrapping - are stored without encryption or expiration and are reachable through at least four distinct channels: the Rancher API, etcd, stored automation artifacts, and direct filesystem access on enrolled nodes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be able to read a registration token from at least one of four locations: the Rancher API (requires low-privilege API credentials), etcd (requires network or local access to the etcd cluster), stored automation artifacts such as CI/CD secrets or infrastructure scripts (requires read access to those systems), or local node files (requires shell access on an already-enrolled node). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 base score of 8.8 (High) uses AV:L, which implies the primary exploitation path is local. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with low-privileged read access to the Rancher API - or with shell access to any enrolled node - reads a registration token stored in plaintext from the API response or from a file on disk. The attacker then uses the token to register a rogue VM or container host as a legitimate node in the downstream cluster, gaining the node's RBAC permissions within Kubernetes and access to any secrets or workloads scheduled onto that node. … |
| Remediation | Consult the vendor advisory at https://github.com/rancher/rancher/security/advisories/GHSA-7r53-jvhg-9jq4 for the patched release version, which was not independently confirmed in the available input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Rancher instances and cluster enrollment activities, implement strict API-level access controls to token endpoints, and enable enhanced logging of cluster join requests. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role
A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network
Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. Rated critical severity (CVSS 9
A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by cr
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, a
Command injection in Rancher Manager’s cluster import endpoint enables remote attackers to deploy malicious containers o
SAML assertion replay in Rancher's Assertion Consumer Service (ACS) handler lets a person-in-the-middle who captures a v
Privilege escalation in SUSE Rancher (Kubernetes management platform) allows a user holding the Project Owner role to im
Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. Rated
Privilege escalation in Rancher 2.13 (before 2.13.6) and 2.14 (before 2.14.2) lets any authenticated user gain principal
A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected
A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as oth
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today