CVE-2026-55998 Cluster Existence Oracle via Unauthenticated Import Endpoint
Attackers can enumerate valid cluster IDs by observing HTTP response differences from an unauthenticated import endpoint, exposing infrastructure topology.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-55998?
CVE-2026-55998 is a medium-severity vulnerability in SUSE Rancher, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.
Weakness: CWE-204
Which versions are affected by CVE-2026-55998?
How do I fix CVE-2026-55998?
No fix has been published for CVE-2026-55998 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-55998 being exploited?
There is no known exploitation of CVE-2026-55998 in the wild and no public exploit code.
Sources
Also known as GHSA-23h9-rr79-r3gh.