CVE-2026-55998

Awaiting Analysis Awaiting Analysis - Queue

Cluster ID Enumeration via HTTP 502 in Kubernetes System Template

Publication date: 2026-08-05

Last updated on: 2026-10-24

Assigner: SUSE

Description

The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-10-24

Generated

2026-11-08

AI Q&A

2026-08-05

EPSS Evaluated

2026-11-07

NVD

CVE-2026-55998

EUVD

EUVD-2026-53258

Affected Vendors & Products

Vendor	Product	Version / Range
rancher	rancher	From 2.11.0 (inc) to 2.11.16 (exc)
rancher	rancher	From 2.12.0 (inc) to 2.12.12 (exc)
rancher	rancher	From 2.13.0 (inc) to 2.13.8 (exc)
rancher	rancher	From 2.14.0 (inc) to 2.14.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-204	The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability in Rancher allows an unauthenticated attacker to check if cluster IDs exist and if they use private registry secrets. The endpoint /v3/import/{token}_{clusterId}.yaml returns HTTP 502 for valid clusters with private registry secrets and HTTP 200 for non-existent clusters, creating a way to enumerate valid clusters and their configurations.

Detection Guidance

To detect this vulnerability, monitor HTTP responses from the endpoint /v3/import/{token}_{clusterId}.yaml. Valid cluster IDs with private registry secrets return HTTP 502, while non-existent cluster IDs return HTTP 200. Automated scripts can probe cluster IDs to observe this difference.

Impact Analysis

Attackers can identify existing clusters and those with private registry secrets, which may help them plan further attacks. This could lead to unauthorized access or data breaches if combined with other vulnerabilities.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR or HIPAA compliance by exposing cluster configurations or allowing data breaches.

Mitigation Strategies

Immediately restrict network access to the vulnerable endpoint. Upgrade Rancher to a patched version (2.14.4, 2.13.8, 2.12.12, or 2.11.16) to validate tokens before cluster lookup and eliminate the side-channel.

Hi! I’m here to help you understand CVE-2026-55998. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...