CNTR-R2-000010 - Rancher RKE2 must protect authenticity of communications sessions with the use of FIPS-validated 140-2 or 140-3 security requirements for cryptographic modules.

CAT|I

CCI|CCI-000068

CCI|CCI-000185

CCI|CCI-000382

CCI|CCI-000803

CCI|CCI-001184

CCI|CCI-001453

CCI|CCI-002420

CCI|CCI-002422

CCI|CCI-002450

Rule-ID|SV-254553r1016525_rule

STIG-ID|CNTR-R2-000010

Vuln-ID|V-254553

CNTR-R2-000030 - RKE2 must use a centralized user management solution to support account management functions.

CAT|II

CCI|CCI-000015

Rule-ID|SV-254554r1043176_rule

STIG-ID|CNTR-R2-000030

Vuln-ID|V-254554

CNTR-R2-000060 - Rancher RKE2 components must be configured in accordance with the security configuration settings based on DOD security configuration or implementation guidance, including SRGs, STIGs, NSA configuration guides, CTOs, and DTMs.

CCI|CCI-000018

CCI|CCI-000130

CCI|CCI-000131

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-000135

CCI|CCI-000172

CCI|CCI-000366

CCI|CCI-001403

CCI|CCI-001404

CCI|CCI-001464

CCI|CCI-001487

CCI|CCI-001851

CCI|CCI-001889

CCI|CCI-001890

CCI|CCI-002130

CCI|CCI-002234

CCI|CCI-002884

CCI|CCI-003938

Rule-ID|SV-254555r1056186_rule

STIG-ID|CNTR-R2-000060

Vuln-ID|V-254555

CNTR-R2-000100 - The Kubernetes Controller Manager must have secure binding.

CCI|CCI-000213

Rule-ID|SV-254556r960792_rule

STIG-ID|CNTR-R2-000100

Vuln-ID|V-254556

CNTR-R2-000110 - The Kubernetes Kubelet must have anonymous authentication disabled.

Rule-ID|SV-254557r960792_rule

STIG-ID|CNTR-R2-000110

Vuln-ID|V-254557

CNTR-R2-000120 - The Kubernetes API server must have the insecure port flag disabled.

Rule-ID|SV-254558r960792_rule

STIG-ID|CNTR-R2-000120

Vuln-ID|V-254558

CNTR-R2-000130 - The Kubernetes Kubelet must have the read-only port flag disabled.

Rule-ID|SV-254559r960792_rule

STIG-ID|CNTR-R2-000130

Vuln-ID|V-254559

CNTR-R2-000140 - The Kubernetes API server must have the insecure bind address not set.

Rule-ID|SV-254560r960792_rule

STIG-ID|CNTR-R2-000140

Vuln-ID|V-254560

CNTR-R2-000150 - The Kubernetes kubelet must enable explicit authorization.

Rule-ID|SV-254561r960792_rule

STIG-ID|CNTR-R2-000150

Vuln-ID|V-254561

CNTR-R2-000160 - The Kubernetes API server must have anonymous authentication disabled.

Rule-ID|SV-254562r960792_rule

STIG-ID|CNTR-R2-000160

Vuln-ID|V-254562

CNTR-R2-000320 - All audit records must identify any containers associated with the event within Rancher RKE2.

Rule-ID|SV-254563r960906_rule

STIG-ID|CNTR-R2-000320

Vuln-ID|V-254563

CNTR-R2-000460 - Rancher RKE2 must be built from verified packages.

CCI|CCI-001749

Rule-ID|SV-268321r1017019_rule

STIG-ID|CNTR-R2-000460

Vuln-ID|V-268321

CNTR-R2-000520 - Configuration and authentication files for Rancher RKE2 must be protected.

CCI|CCI-001499

Rule-ID|SV-254564r1016531_rule

STIG-ID|CNTR-R2-000520

Vuln-ID|V-254564

CNTR-R2-000550 - Rancher RKE2 must be configured with only essential configurations.

CCI|CCI-000381

CCI|CCI-001764

Rule-ID|SV-254565r960963_rule

STIG-ID|CNTR-R2-000550

Vuln-ID|V-254565

CNTR-R2-000580 - Rancher RKE2 runtime must enforce ports, protocols, and services that adhere to the PPSM CAL.

CCI|CCI-001762

Rule-ID|SV-254566r1050657_rule

STIG-ID|CNTR-R2-000580

Vuln-ID|V-254566

CNTR-R2-000800 - Rancher RKE2 must store only cryptographic representations of passwords.

CCI|CCI-000196

CCI|CCI-004062

Rule-ID|SV-254567r1016559_rule

STIG-ID|CNTR-R2-000800

Vuln-ID|V-254567

CNTR-R2-000890 - Rancher RKE2 must terminate all network connections associated with a communications session at the end of the session, or as follows: for in-band management sessions (privileged sessions), the session must be terminated after five minutes of inactivity.

CCI|CCI-001133

Rule-ID|SV-254568r1016534_rule

STIG-ID|CNTR-R2-000890

Vuln-ID|V-254568

CNTR-R2-000940 - Rancher RKE2 runtime must isolate security functions from nonsecurity functions.

CCI|CCI-001084

Rule-ID|SV-254569r1016537_rule

STIG-ID|CNTR-R2-000940

Vuln-ID|V-254569

CNTR-R2-000970 - Rancher RKE2 runtime must maintain separate execution domains for each container by assigning each container a separate address space to prevent unauthorized and unintended information transfer via shared system resources.

CCI|CCI-001082

CCI|CCI-001090

CCI|CCI-002530

Rule-ID|SV-254570r1016539_rule

STIG-ID|CNTR-R2-000970

Vuln-ID|V-254570

CNTR-R2-001130 - Rancher RKE2 must prevent nonprivileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

CCI|CCI-002233

CCI|CCI-002235

Rule-ID|SV-254571r961353_rule

STIG-ID|CNTR-R2-001130

Vuln-ID|V-254571

CNTR-R2-001270 - Rancher RKE2 must prohibit the installation of patches, updates, and instantiation of container images without explicit privileged status.

CCI|CCI-001812

CCI|CCI-003980

Rule-ID|SV-254572r1016560_rule

STIG-ID|CNTR-R2-001270

Vuln-ID|V-254572

CNTR-R2-001500 - Rancher RKE2 keystore must implement encryption to prevent unauthorized disclosure of information at rest within Rancher RKE2.

CCI|CCI-002476

Rule-ID|SV-254573r1050650_rule

STIG-ID|CNTR-R2-001500

Vuln-ID|V-254573

CNTR-R2-001580 - Rancher RKE2 must remove old components after updated versions have been installed.

CCI|CCI-002617

Rule-ID|SV-254574r961677_rule

STIG-ID|CNTR-R2-001580

Vuln-ID|V-254574

CNTR-R2-001620 - Rancher RKE2 registry must contain the latest images with most recent updates and execute within Rancher RKE2 runtime as authorized by IAVM, CTOs, DTMs, and STIGs.

CCI|CCI-002605

Rule-ID|SV-254575r961683_rule

STIG-ID|CNTR-R2-001620

Vuln-ID|V-254575

DISA_STIG_Rancher_Government_Solutions_RKE2_v2r3.audit from DISA Rancher Government Solutions RKE2 STIG v2r3

Detections

Analytics

Revision 1.2Dec 10, 2025

Miscellaneous

Added

Removed