CVE-2026-55998 SUSE CVE debrief

Who should care

Rancher users, SUSE users, and administrators of clusters with private registry secrets configured should review and mitigate this vulnerability to prevent potential enumeration attacks. Affected operators should verify cluster configurations and monitor for suspicious traffic patterns. Vulnerability management and security teams should prioritize defensive review and implement compensating controls to limit exposure.

Technical summary

A nil pointer dereference vulnerability exists in the /v3/import/{token}_{clusterId}.yaml endpoint. When a valid cluster ID with private registry secrets is provided, the request returns an HTTP 502 Bad Gateway response. In contrast, non-existent cluster IDs return an HTTP 200 response. This difference in response codes can be exploited as a reliable enumeration oracle. The vulnerability is caused by a nil pointer dereference in pkg/systemtemplate/private_registry.go. To verify, defenders should review cluster configurations, monitor for suspicious traffic patterns, and consider rate limiting or IP blocking.

Defensive priority

Medium-priority defensive review recommended due to potential enumeration oracle.

Recommended defensive actions

• Verify cluster ID validation and token authentication in /v3/import/{token}_{clusterId}.yaml endpoint
• Implement compensating controls to monitor and limit enumeration attempts
• Inventory and review cluster configurations for private registry secrets
• Consider rate limiting or IP blocking for suspicious traffic patterns
• Review vendor patch guidance for affected systems
• Conduct exposure review for potentially affected assets
• Track exceptions and retest remediated assets

Evidence notes

Evidence is limited; primary official records indicate a potential enumeration oracle via observable differences in HTTP response codes for valid and non-existent cluster IDs. The vulnerability exists in the /v3/import/{token}_{clusterId}.yaml endpoint, where a valid cluster ID with private registry secrets configured causes a nil pointer dereference, leading to an HTTP 502 Bad Gateway response. In contrast, non-existent cluster IDs return an HTTP 200 response. This difference in response codes can be exploited as a reliable enumeration oracle. To verify, defenders should review cluster configurations, monitor for suspicious traffic patterns, and consider rate limiting or IP blocking.

Official resources