CVE-2026-55998
Received Received - Intake

Cluster ID Enumeration via HTTP 502 in Kubernetes System Template

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: SUSE

Description
The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-55998
EUVD
EUVD-2026-53258

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
rancher rancher From 2.11.0 (inc) to 2.11.16 (exc)
rancher rancher From 2.12.0 (inc) to 2.12.12 (exc)
rancher rancher From 2.13.0 (inc) to 2.13.8 (exc)
rancher rancher From 2.14.0 (inc) to 2.14.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-204 The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Rancher allows an unauthenticated attacker to check if cluster IDs exist and if they use private registry secrets. The endpoint /v3/import/{token}_{clusterId}.yaml returns HTTP 502 for valid clusters with private registry secrets and HTTP 200 for non-existent clusters, creating a way to enumerate valid clusters and their configurations.

Detection Guidance

To detect this vulnerability, monitor HTTP responses from the endpoint /v3/import/{token}_{clusterId}.yaml. Valid cluster IDs with private registry secrets return HTTP 502, while non-existent cluster IDs return HTTP 200. Automated scripts can probe cluster IDs to observe this difference.

Impact Analysis

Attackers can identify existing clusters and those with private registry secrets, which may help them plan further attacks. This could lead to unauthorized access or data breaches if combined with other vulnerabilities.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR or HIPAA compliance by exposing cluster configurations or allowing data breaches.

Mitigation Strategies

Immediately restrict network access to the vulnerable endpoint. Upgrade Rancher to a patched version (2.14.4, 2.13.8, 2.12.12, or 2.11.16) to validate tokens before cluster lookup and eliminate the side-channel.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55998. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart