What is the CVSS score of CVE-2026-55998?

CVE-2026-55998 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-55998?

Yes, a patch is available for CVE-2026-55998. Update the affected software to the latest version immediately.

SUSE Rancher CVE-2026-55998

EUVD-2026-53258 MEDIUM

Observable Response Discrepancy (CWE-204)

2026-08-05 suse

Information Disclosure Oracle Rancher Suse

5.3

CVSS 3.1 · Vendor: suse

Severity by source

Vendor (suse) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated endpoint; impact is cluster ID enumeration only (C:L), no integrity or availability consequences.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 05, 2026 - 09:01 EUVD

Analysis Generated

Aug 05, 2026 - 08:38 vuln.today

DescriptionCVE.org

The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.

AnalysisAI

Cluster ID enumeration in SUSE Rancher exposes a reliable oracle via the unauthenticated /v3/import/{token}_{clusterId}.yaml endpoint, which performs cluster object retrieval before token validation. Remote unauthenticated attackers can distinguish valid cluster IDs (HTTP 502, triggered by a nil pointer dereference in pkg/systemtemplate/private_registry.go when private registry secrets exist) from non-existent ones (HTTP 200), leaking the presence and private-registry configuration status of clusters. This is not listed in CISA KEV and no public exploit code has been identified, but the zero-prerequisite network accessibility makes enumeration trivially scriptable.

Technical ContextAI

SUSE Rancher is an open-source Kubernetes multi-cluster management platform. The vulnerable endpoint /v3/import/{token}_{clusterId}.yaml is part of Rancher's cluster import API, used to generate kubeconfig-style manifests for joining downstream clusters. The root cause is CWE-204 (Observable Response Discrepancy): the application resolves the cluster object from the database using the supplied clusterId path parameter prior to validating the token component. When a cluster exists and has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go surfaces as an HTTP 502 Bad Gateway before authentication ever completes. When the cluster ID is absent from the database, the endpoint returns HTTP 200. This ordering inversion - lookup before auth - is the structural flaw. The CPE cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* covers all Rancher versions, indicating no version range narrowing has been published in the available data.

RemediationAI

Apply the vendor-supplied patch documented in GitHub Security Advisory GHSA-23h9-rr79-r3gh (https://github.com/rancher/rancher/security/advisories/GHSA-23h9-rr79-r3gh) and SUSE Bugzilla https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55998. An exact patched version number is not confirmed from available data - consult the advisory directly for the specific fix release. As a compensating control prior to patching, restrict network access to the /v3/import/ API path to trusted IP ranges using firewall rules or an ingress network policy; note this may interrupt legitimate cluster import workflows where downstream clusters must reach the Rancher API. Alternatively, placing an authenticated reverse proxy in front of the Rancher API endpoint - one that validates the token before forwarding the request - would neutralize the oracle entirely, though this introduces operational complexity around certificate management and import flow compatibility.