A vulnerability in Rancher allows for the exposure of long-lived registration tokens, creating a significant risk of unauthorized cluster access.

This issue is classified as CWE-312: Cleartext storage of sensitive information. It involves the issuance of long-lived tokens for node and agent authentication, which can be intercepted or accessed by authenticated local users.

Successful exploitation permits unauthorized access to downstream clusters, potentially leading to full cluster compromise. With a CVSS score of 8.8, this high-severity flaw poses a major risk to environment integrity, confidentiality, and operational stability.

Immediate Action: Upgrade Rancher to version 2.14.4, 2.13.8, or later to ensure proper token handling and lifecycle management.

Proactive Monitoring: Review cluster access logs for anomalous registration attempts or unexpected node additions.

Compensating Controls: Restrict local access to the Rancher management interface and enforce strict identity and access management policies for administrative users.

Public Exploit Available: No

Administrators must prioritize updating their Rancher deployments to the patched versions immediately. The exposure of long-lived tokens creates a window of opportunity for attackers to gain persistent, unauthorized access to critical infrastructure, making rapid remediation essential to maintaining cluster security.