CVE-2026-55998

{
  "id": "CVE-2026-55998",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-05T08:16:34.460",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle."
    },
    {
      "lang": "es",
      "value": "El endpoint /v3/import/{token}_{clusterId}.yaml recupera el objeto del clúster antes de validar el token. Cuando un ID de clúster válido hace referencia a un clúster que tiene secretos de registro privado configurados, una desreferencia de puntero nulo en pkg/systemtemplate/private_registry.go provoca que la solicitud devuelva HTTP 502 Bad Gateway. Para los ID de clúster que no existen, el endpoint devuelve HTTP 200. Esta diferencia observable en los códigos de respuesta constituye un oráculo de enumeración fiable."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SUSE",
          "product": "Rancher",
          "defaultStatus": "unaffected",
          "packageName": "Rancher",
          "versions": [
            {
              "version": "2.14.0",
              "lessThan": "2.14.4",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.13.0",
              "lessThan": "2.13.8",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.12.0",
              "lessThan": "2.12.12",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.11.0",
              "lessThan": "2.11.16",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-05T13:11:15.281747Z",
          "id": "CVE-2026-55998",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-204"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55998",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/rancher/rancher/security/advisories/GHSA-23h9-rr79-r3gh",
      "source": "[email protected]"
    }
  ]
}