CVE-2026-55998

MEDIUM 5.3

Cluster Existence Oracle via Unauthenticated Import Endpoint

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.

CWE	CWE-204
Vendor	suse
Product	rancher
Published	Aug 5, 2026

Stay Ahead of the Next One

Get instant alerts for suse rancher

Be the first to know when new medium vulnerabilities affecting suse rancher are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

SUSE / Rancher

2.14.0 < 2.14.4 2.13.0 < 2.13.8 2.12.0 < 2.12.12 2.11.0 < 2.11.16

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rancher/rancher/security/advisories/GHSA-23h9-rr79-r3gh bugzilla.suse.com: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55998

Credits

This vulnerability was discovered and reported by Michael Wollner (@ibonok) from Deutsche Telekom AG.