CVE-2026-55998

The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55998
https://github.com/rancher/rancher/security/advisories/GHSA-23h9-rr79-r3gh

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El endpoint /v3/import/{token}_{clusterId}.yaml recupera el objeto del clúster antes de validar el token. Cuando un ID de clúster válido hace referencia a un clúster que tiene secretos de registro privado configurados, una desreferencia de puntero nulo en pkg/systemtemplate/private_registry.go provoca que la solicitud devuelva HTTP 502 Bad Gateway. Para los ID de clúster que no existen, el endpoint devuelve HTTP 200. Esta diferencia observable en los códigos de respuesta constituye un oráculo de enumeración fiable.

Information

Published : 2026-08-05 08:16

Updated : 2026-10-24 16:10

NVD link : CVE-2026-55998

Mitre link : CVE-2026-55998

CVE.ORG link : CVE-2026-55998

JSON object : View

Products Affected

No product.

CWE

CWE-204

Observable Response Discrepancy

{"id": "CVE-2026-55998", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55998", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T13:11:15.281747Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "meissner@suse.de", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "meissner@suse.de", "affectedData": [{"vendor": "SUSE", "product": "Rancher", "versions": [{"status": "affected", "version": "2.14.0", "lessThan": "2.14.4", "versionType": "semver"}, {"status": "affected", "version": "2.13.0", "lessThan": "2.13.8", "versionType": "semver"}, {"status": "affected", "version": "2.12.0", "lessThan": "2.12.12", "versionType": "semver"}, {"status": "affected", "version": "2.11.0", "lessThan": "2.11.16", "versionType": "semver"}], "packageName": "Rancher", "defaultStatus": "unaffected"}]}], "published": "2026-08-05T08:16:34.460", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55998", "source": "meissner@suse.de"}, {"url": "https://github.com/rancher/rancher/security/advisories/GHSA-23h9-rr79-r3gh", "source": "meissner@suse.de"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "meissner@suse.de", "description": [{"lang": "en", "value": "CWE-204"}]}], "descriptions": [{"lang": "en", "value": "The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle."}, {"lang": "es", "value": "El endpoint /v3/import/{token}_{clusterId}.yaml recupera el objeto del cl\u00faster antes de validar el token. Cuando un ID de cl\u00faster v\u00e1lido hace referencia a un cl\u00faster que tiene secretos de registro privado configurados, una desreferencia de puntero nulo en pkg/systemtemplate/private_registry.go provoca que la solicitud devuelva HTTP 502 Bad Gateway. Para los ID de cl\u00faster que no existen, el endpoint devuelve HTTP 200. Esta diferencia observable en los c\u00f3digos de respuesta constituye un or\u00e1culo de enumeraci\u00f3n fiable."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "meissner@suse.de"}