CVE-2026-55998

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The endpoint '/v3/import/{token} {clusterId}.yaml' retrieves the cluster object before validating the token. A nil pointer dereference occurs in pkg/systemtemplate/private registry.go when a valid clusterId references a cluster with private registry secrets configured, resulting in an HTTP 502 Bad Gateway response. Conversely, requests for non-existent cluster IDs return HTTP 200. This difference in response codes creates an enumeration oracle, allowing an attacker to distinguish between existing and non-existing cluster IDs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.