CVE-2026-55998 — Cluster Existence Oracle via Unauthenticated Import Endpoint
The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry…
Published: 2026-08-05 · CVSS: 5.3 · CVSS 3.1
The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7