CyberRota Analysis
AI-GeneratedRancher’s long-lived registration tokens, which are used for authenticating nodes and agents in downstream clusters, are vulnerable due to being stored in plaintext without expiration. This allows an attacker to potentially access these tokens through various means, such as the Rancher API or direct file access, enabling them to register unauthorized nodes within the cluster. Organizations using Rancher should prioritize addressing this vulnerability to prevent unauthorized access and potential compromise of their cluster environments.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, stored automation, or direct file access on a node, and could use it at any time to register a rogue node into the cluster.