CVE-2026-55998 Details
Description
The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.
A vulnerability exists in Rancher versions 2.11.0 prior to 2.11.16, 2.12.0 prior to 2.12.12, 2.13.0 prior to 2.13.8, and 2.14.0 prior to 2.14.4. The issue arises in the unauthenticated cluster import endpoint, specifically `/v3/import/{token}_{clusterId}.yaml`. This endpoint retrieves cluster objects without validating tokens first. When a valid cluster ID associated with private registry secrets is queried, a nil pointer dereference occurs, causing the server to respond with `HTTP 502 Bad Gateway`. In contrast, requests for non-existent cluster IDs receive an `HTTP 200` response. This discrepancy in response codes can be exploited to reliably enumerate valid cluster IDs and identify those configured with private registry secrets.
Users can upgrade to Rancher versions 2.14.4, 2.13.8, 2.12.12, or 2.11.16. If an immediate upgrade is not possible, network access to the Rancher API import endpoint can be restricted to trusted networks using a firewall, reverse proxy, or network policy.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55998 | [email protected] | |
| https://github.com/rancher/rancher/security/advisories/GHSA-23h9-rr79-r3gh | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-204 | Observable Response Discrepancy | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |