CVE-2026-55998: The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that…

PriorityP428medium5.3CVSS 3.1

AVNACLPRNUINSUCLINAN

EPSS

0.21%

10.9th percentile

The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
suse	rancher	>= 2.11.0 < 2.11.16	2.11.16
suse	rancher	>= 2.12.0 < 2.12.12	2.12.12
suse	rancher	>= 2.13.0 < 2.13.8	2.13.8
suse	rancher	>= 2.14.0 < 2.14.4	2.14.4

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.