Rancher generates long‑lived registration tokens that authenticate nodes and agents joining downstream clusters. These tokens are stored in plaintext and have no expiration policy. Exposed tokens can be obtained through the Rancher API, etcd data, automation scripts, or direct file access on a node and can be used at any time to register a rogue node. This grants an attacker the privileges of a legitimate node, enabling the execution of workloads, exposure of cluster state, or lateral movement within the cluster. The flaw is a classic credential‑dumping issue, classified as CWE‑312, and does not require local system compromise once the token is acquired.

Rancher Rancher is affected. No specific product version or release is listed in the CNA data; the flaw applies to the default token generation and storage logic within Rancher’s node registration system.

The vulnerability has a CVSS score of 8.8, indicating high severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog, suggesting it may not be actively exploited in the wild yet. However, the long‑lived, plaintext nature of the tokens means an attacker who can read the token through the API, etcd, automation scripts, or node file access can immediately register a rogue node. The attack does not require privileged access beyond the normal API/etcd credentials and can be completed by anyone able to interact with the Rancher API or the node file system.