Skip to main content

SUSE Rancher CVE-2026-55998

| EUVDEUVD-2026-53258 MEDIUM
Observable Response Discrepancy (CWE-204)
2026-08-05 suse
Information Disclosure Oracle Rancher Suse
5.3
CVSS 3.1 · Vendor: suse
Share

Severity by source

Vendor (suse) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vuln.today AI
5.3 MEDIUM

Network-accessible unauthenticated endpoint; impact is cluster ID enumeration only (C:L), no integrity or availability consequences.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

2
Patch available
Aug 05, 2026 - 09:01 EUVD
Analysis Generated
Aug 05, 2026 - 08:38 vuln.today

DescriptionCVE.org

The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.

AnalysisAI

Cluster ID enumeration in SUSE Rancher exposes a reliable oracle via the unauthenticated /v3/import/{token}_{clusterId}.yaml endpoint, which performs cluster object retrieval before token validation. Remote unauthenticated attackers can distinguish valid cluster IDs (HTTP 502, triggered by a nil pointer dereference in pkg/systemtemplate/private_registry.go when private registry secrets exist) from non-existent ones (HTTP 200), leaking the presence and private-registry configuration status of clusters. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify reachable Rancher API endpoint
Delivery
Send unauthenticated GET to /v3/import/{token}_{clusterId}.yaml
Exploit
Observe HTTP 502 (cluster exists, private registry configured) vs HTTP 200 (no cluster)
Execution
Enumerate valid cluster IDs at scale
Persist
Prioritize clusters with private registry secrets
Impact
Leverage confirmed IDs in targeted follow-on attacks
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No authentication is required - the CVSS vector PR:N confirms unauthenticated access is sufficient. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD-assigned CVSS 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N is internally consistent with the described behavior: unauthenticated, low-complexity network access yielding partial confidentiality loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker scripting sequential HTTP GET requests to `/v3/import/arbitrary_token_{guessed_clusterId}.yaml` iterates over candidate cluster ID values and classifies each by response code: HTTP 502 confirms the cluster exists and has private registry secrets configured, while HTTP 200 confirms the ID is unoccupied. Within minutes, the attacker maps all valid cluster IDs on the Rancher instance, identifying which clusters are higher-value targets due to private registry configuration, and feeds those confirmed IDs into subsequent authenticated attack attempts. …
Remediation Apply the vendor-supplied patch documented in GitHub Security Advisory GHSA-23h9-rr79-r3gh (https://github.com/rancher/rancher/security/advisories/GHSA-23h9-rr79-r3gh) and SUSE Bugzilla https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55998. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Rancher

View all
CVE-2022-31247 CRITICAL POC
9.1 Sep 07

An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role
CVE-2022-21951 MEDIUM POC
6.8 May 25

A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network
CVE-2023-22651 CRITICAL
9.9 May 04

Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. Rated critical severity (CVSS 9
CVE-2021-25320 CRITICAL
9.9 Jul 15

A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by cr
CVE-2019-11202 CRITICAL
9.8 Jul 30

An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, a
CVE-2026-44939 CRITICAL
9.4 Jun 19

Command injection in Rancher Manager’s cluster import endpoint enables remote attackers to deploy malicious containers o
CVE-2026-44946 CRITICAL
9.5 Jun 30

SAML assertion replay in Rancher's Assertion Consumer Service (ACS) handler lets a person-in-the-middle who captures a v
CVE-2026-41052 CRITICAL
9.4 Jun 29

Privilege escalation in SUSE Rancher (Kubernetes management platform) allows a user holding the Project Owner role to im
CVE-2017-7297 HIGH
8.8 Mar 29

Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. Rated

CVE-2026-41053 HIGH
8.8 Jun 30

Privilege escalation in Rancher 2.13 (before 2.13.6) and 2.14 (before 2.14.2) lets any authenticated user gain principal
CVE-2026-55997 HIGH
8.8 Aug 05

Cleartext registration token exposure in Rancher allows a low-privileged user to obtain perpetually valid cluster join t
CVE-2023-22648 HIGH
8.8 Jun 01

A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected

Same weakness CWE-204 – Observable Response Discrepancy

View all
CVE-2018-25350 CRITICAL POC
9.3
CVE-2024-28232 HIGH POC
7.5
CVE-2024-24766 HIGH POC
7.5
CVE-2026-54768 MEDIUM POC
6.9
CVE-2025-66307 MEDIUM POC
6.5
CVE-2024-6056 MEDIUM POC
6.3
CVE-2025-30150 MEDIUM POC
5.5
CVE-2024-55198 MEDIUM POC
5.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Share

CVE-2026-55998 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy