CVE-2026-55998

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55998", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2026-06-18T09:26:55.988Z", "datePublished": "2026-08-05T07:51:21.731Z", "dateUpdated": "2026-08-05T13:13:02.031Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-08-05T07:51:21.731Z"}, "title": "Cluster Existence Oracle via Unauthenticated Import Endpoint", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-204", "description": "CWE-204 Observable response discrepancy", "type": "CWE"}]}], "affected": [{"vendor": "SUSE", "product": "Rancher", "packageName": "Rancher", "versions": [{"status": "affected", "version": "2.14.0", "lessThan": "2.14.4", "versionType": "semver"}, {"status": "affected", "version": "2.13.0", "lessThan": "2.13.8", "versionType": "semver"}, {"status": "affected", "version": "2.12.0", "lessThan": "2.12.12", "versionType": "semver"}, {"status": "affected", "version": "2.11.0", "lessThan": "2.11.16", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><span>The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.</span></p>"}]}], "references": [{"url": "https://github.com/rancher/rancher/security/advisories/GHSA-23h9-rr79-r3gh"}, {"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55998"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "credits": [{"lang": "en", "value": "This vulnerability was discovered and reported by Michael Wollner (@ibonok) from Deutsche Telekom AG.", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T13:11:15.281747Z", "id": "CVE-2026-55998", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T13:13:02.031Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55998", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2026-06-18T09:26:55.988Z", "datePublished": "2026-08-05T07:51:21.731Z", "dateUpdated": "2026-08-05T13:13:02.031Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-08-05T07:51:21.731Z"}, "title": "Cluster Existence Oracle via Unauthenticated Import Endpoint", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-204", "description": "CWE-204 Observable response discrepancy", "type": "CWE"}]}], "affected": [{"vendor": "SUSE", "product": "Rancher", "packageName": "Rancher", "versions": [{"status": "affected", "version": "2.14.0", "lessThan": "2.14.4", "versionType": "semver"}, {"status": "affected", "version": "2.13.0", "lessThan": "2.13.8", "versionType": "semver"}, {"status": "affected", "version": "2.12.0", "lessThan": "2.12.12", "versionType": "semver"}, {"status": "affected", "version": "2.11.0", "lessThan": "2.11.16", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><span>The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.</span></p>"}]}], "references": [{"url": "https://github.com/rancher/rancher/security/advisories/GHSA-23h9-rr79-r3gh"}, {"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55998"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "credits": [{"lang": "en", "value": "This vulnerability was discovered and reported by Michael Wollner (@ibonok) from Deutsche Telekom AG.", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55998", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T13:11:15.281747Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T13:12:57.879Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "Rancher", "product": "Rancher", "vendor": "SUSE", "versions": [{"lessThan": "2.14.4", "status": "affected", "version": "2.14.0", "versionType": "semver"}, {"lessThan": "2.13.8", "status": "affected", "version": "2.13.0", "versionType": "semver"}, {"lessThan": "2.12.12", "status": "affected", "version": "2.12.0", "versionType": "semver"}, {"lessThan": "2.11.16", "status": "affected", "version": "2.11.0", "versionType": "semver"}]}], "source": "meissner@suse.de"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle."}, {"lang": "es", "value": "El endpoint /v3/import/{token}_{clusterId}.yaml recupera el objeto del cl\u00faster antes de validar el token. Cuando un ID de cl\u00faster v\u00e1lido hace referencia a un cl\u00faster que tiene secretos de registro privado configurados, una desreferencia de puntero nulo en pkg/systemtemplate/private_registry.go provoca que la solicitud devuelva HTTP 502 Bad Gateway. Para los ID de cl\u00faster que no existen, el endpoint devuelve HTTP 200. Esta diferencia observable en los c\u00f3digos de respuesta constituye un or\u00e1culo de enumeraci\u00f3n fiable."}], "id": "CVE-2026-55998", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "meissner@suse.de", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55998", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T13:11:15.281747Z", "version": "2.0.3"}}]}, "published": "2026-08-05T08:16:34.460", "references": [{"source": "meissner@suse.de", "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55998"}, {"source": "meissner@suse.de", "url": "https://github.com/rancher/rancher/security/advisories/GHSA-23h9-rr79-r3gh"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-204"}], "source": "meissner@suse.de", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.14.0,2.14.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.13.0,2.13.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.12.0,2.12.12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.11.0,2.11.16)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Rancher", "source": "cna", "vendor": "SUSE"}, "product": "rancher", "vendor": "suse"}], "created": "2026-08-05T09:30:11.604732+00:00", "updated": "2026-08-05T10:00:03.414321+00:00", "vendors": ["suse", "suse$PRODUCT$rancher"]}