Rancher generated tokens not revoked after modifications made to authentication provider — github.com/rancher/rancher
Improper AuthenticationImpact
This issue affects Rancher versions from 2.5.0 up to and including 2.5.16, from 2.6.0 up to and including 2.6.9 and 2.7.0. It only affects Rancher setups that have an external authentication provider configured or had one configured in the past.
It was discovered that when an external authentication provider is configured in Rancher and then disabled, the Rancher generated tokens associated with users who had access granted through the now disabled auth provider are not revoked. This allows users to retain access to Rancher and kubectl access to clusters managed by Rancher, according to their previous configured permissions, even after they are supposed to have lost it due to the auth provider been disabled.
The problem also occurs if the auth provider is configured (and is still enabled) to use the access level scopes allow members of clusters and projects, plus authorized users & groups and restrict access to only the authorized users & groups. In this case, removing users and groups from the authorized lists will not revoke the access tokens and they will remain valid.
An example scenario is:
- OpenLDAP, MS Active Directory (AD) or any other external authentication provider is configured as an auth provider.
- A user (
cluster-owner) is grantedcluster-ownerpermissions on a downstream cluster (test-cluster). cluster-ownerlogs in using their external auth provider username and password.cluster-ownergenerates akubeconfigtoken fortest-cluster.- The configured external auth provider is disabled.
In this scenario, the kubeconfig generated in step 4 will still be valid after step 5, and test-cluster can still be accessed using the kubeconfig token.
By default, tokens for authenticated session have their ttl (time to live) set to 960 minutes, so they will expire after 16 hours. kubeconfig tokens are configured to never expire, and their ttl is set to 0. These configurations can be changed in the Rancher's settings (Configuration > Global Settings > Settings) with the parameters auth-user-session-ttl-minutes and kubeconfig-default-token-ttl-minutes, respectively.
Workarounds
If you cannot update to a patched Rancher version, the recommended workaround is to review and remove tokens associated with auth providers manually.
The tokens can be reviewed by executing kubectl get tokens in Rancher's local cluster. Each found token must be manually reviewed to check if it belongs to a user from a disabled auth provider or a user who's access was previously removed from the auth provider (when the auth provider is still enabled and is or was configured to use access level scopes, as mentioned above). The identified tokens can be removed with kubectl delete tokens <token_name>.
It is important to mention that this workaround must be done every time an auth provider is disabled in case you cannot update to a patched version.
Patches
Patched versions include releases 2.5.17, 2.6.10, 2.7.1 and later versions. After updating to a patched version, it is highly recommended to review the existing tokens and remove tokens related to disabled auth providers as described above in the workaround section.
For more information
If you have any questions or comments about this advisory:
- Reach out to SUSE Rancher Security team for security related inquiries.
- Open an issue in Rancher repository.
- Verify our support matrix and product support lifecycle.
| Software | From | Fixed in |
|---|---|---|
github.com/rancher/rancher
|
2.5.0 | 2.5.17 |
|
github.com/rancher/rancher
|
2.6.0 | 2.6.10 |
|
github.com/rancher/rancher
|
2.7.0 | 2.7.1 |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime
Frequently Asked Questions
A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.
CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.
A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.
Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.
Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.
SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.