CVE-2026-55998: Information Disclosure Vulnerability

CVE-2026-55998 Overview

CVE-2026-55998 is an information disclosure vulnerability in Rancher's /v3/import/{token}_{clusterId}.yaml endpoint. The endpoint retrieves the cluster object before validating the supplied token. When a valid cluster ID references a cluster configured with private registry secrets, a nil pointer dereference in pkg/systemtemplate/private_registry.go returns HTTP 502 Bad Gateway. Requests for nonexistent cluster IDs return HTTP 200. Attackers can use this response-code difference as a reliable enumeration oracle to identify valid cluster identifiers without authentication. The issue is tracked as [CWE-204: Observable Response Discrepancy].

Critical Impact
Unauthenticated network attackers can enumerate valid Rancher cluster IDs by observing HTTP response code differences, exposing internal cluster inventory.

Affected Products

Rancher (rancher/rancher)
SUSE Rancher distributions
Deployments exposing the /v3/import/{token}_{clusterId}.yaml endpoint

Discovery Timeline

2026-08-05 - CVE-2026-55998 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-55998

Vulnerability Analysis

The vulnerable endpoint /v3/import/{token}_{clusterId}.yaml is designed to deliver cluster import manifests to registering nodes. The handler performs cluster lookup before token validation, inverting the expected authorization sequence. This ordering allows unauthenticated requests to influence server-side processing based on whether the referenced cluster exists.

When the supplied cluster ID matches an existing cluster that has private registry secrets configured, the code path in pkg/systemtemplate/private_registry.go triggers a nil pointer dereference. The dereference is caught upstream and surfaced as an HTTP 502 Bad Gateway. Nonexistent cluster IDs never reach that code path and return HTTP 200. The two distinct responses form an oracle that reveals cluster existence.

Root Cause

The root cause is twofold. First, the handler retrieves cluster state before validating the request token, violating the principle of authenticate-then-authorize-then-act. Second, private_registry.go fails to guard against a nil registry secret structure, producing a runtime panic that translates to an observable error response. Together these defects create a side channel through server behavior.

Attack Vector

An unauthenticated remote attacker iterates candidate cluster identifiers against the /v3/import/{token}_{clusterId}.yaml endpoint using an arbitrary token value. A response of HTTP 502 indicates the cluster ID is valid and has private registry secrets. A response of HTTP 200 indicates the cluster ID does not exist. Enumerated cluster IDs can then be used to focus subsequent attacks against the Rancher management plane, including targeted attempts at token guessing or exploitation of other cluster-scoped endpoints.

No verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-23h9-rr79-r3gh for maintainer-provided technical details.

Detection Methods for CVE-2026-55998

Indicators of Compromise

High-volume requests to /v3/import/{token}_{clusterId}.yaml from a single source with varying clusterId values
Bursts of HTTP 502 responses from the Rancher server correlated with private-registry-enabled clusters
Requests using clearly invalid or randomized token strings against the import endpoint
Access to the import endpoint from IP ranges outside expected node bootstrap networks

Detection Strategies

Alert when a single client generates more than a small threshold of /v3/import/ requests within a short window
Correlate HTTP 502 responses from the Rancher API with the requesting source IP and user agent to identify enumeration patterns
Baseline normal cluster import activity and flag deviations in request frequency or token entropy
Compare requested clusterId values across sessions to detect brute-force iteration

Monitoring Recommendations

Enable verbose access logging on the Rancher management plane, capturing full request paths and response codes
Forward Rancher API logs to a centralized analytics platform for retention and query
Monitor panic and stack-trace events in Rancher server logs referencing pkg/systemtemplate/private_registry.go
Track the ratio of 200 to 502 responses on the import endpoint over time as an anomaly signal

How to Mitigate CVE-2026-55998

Immediate Actions Required

Upgrade Rancher to the fixed release identified in the GitHub Security Advisory GHSA-23h9-rr79-r3gh
Restrict network exposure of the Rancher management API to trusted node bootstrap networks and administrative sources
Review access logs for prior enumeration attempts against /v3/import/ and preserve evidence
Rotate any cluster registration tokens suspected of exposure during the window of vulnerability

Patch Information

Refer to the Rancher security advisory GHSA-23h9-rr79-r3gh and the SUSE Bugzilla entry for CVE-2026-55998 for the list of fixed versions and vendor guidance. The fix reorders token validation ahead of cluster retrieval and adds nil checks to the private registry code path.

Workarounds

Place the Rancher management endpoint behind an authenticating reverse proxy or VPN
Apply Web Application Firewall rules that rate-limit requests to /v3/import/ and block clients producing repeated 502 responses
Temporarily restrict source IPs permitted to reach the import endpoint using network policy or firewall rules
Disable private registry configuration on clusters where feasible until the patch is applied

bash

# Example NetworkPolicy restricting access to the Rancher management namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-rancher-import
  namespace: cattle-system
spec:
  podSelector:
    matchLabels:
      app: rancher
  policyTypes:
    - Ingress
  ingress:
    - from:
        - ipBlock:
            cidr: 10.0.0.0/8
      ports:
        - protocol: TCP
          port: 443