STIGQter: STIG Summary: Rancher Government Solutions RKE2 Security Technical Implementation Guide Version: 2 Release: 7 Benchmark Date: 01 Jul 2026:

Rancher RKE2 registry must contain the latest images with most recent updates and execute within Rancher RKE2 runtime as authorized by IAVM, CTOs, DTMs, and STIGs.

DISA Rule

SV-254575r1137649_rule

Vulnerability Number

V-254575

Group Title

SRG-APP-000456-CTR-001125

Rule Version

CNTR-R2-001620

Severity

CAT II

CCI(s)

CCI-002605 - Install security-relevant software updates within an organization-defined time period of the release of the updates.

Weight

Fix Recommendation

Upgrade RKE2 to the supported version. Institute and adhere to the policies and procedures to ensure that patches are consistently applied within the time allowed.

Check Contents

Authenticate on the RKE2 Control Plane.

Verify all nodes in the cluster are running a supported version of RKE2 Kubernetes.
Run command:

kubectl get nodes

If any nodes are running an unsupported version of RKE2 Kubernetes, this is a finding.

Verify all images running in the cluster are patched to the latest version.
Run command:

kubectl get pods --all-namespaces -o jsonpath="{.items[*].spec.containers[*].image}" | tr -s '[[:space:]]' '\n' | sort | uniq -c

If any images running in the cluster are not the latest version, this is a finding.

Note: Kubernetes release support levels can be found at: https://kubernetes.io/releases/

Rancher RKE2 registry must contain the latest images with most recent updates and execute within Rancher RKE2 runtime as authorized by IAVM, CTOs, DTMs, and STIGs.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key