The vulnerability exists in the /v3/import/{token}_{clusterId}.yaml endpoint of SUSE Rancher. The endpoint fetches the cluster object prior to token validation. If a valid cluster ID references a cluster with private registry secrets, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the endpoint to return an HTTP 502 Bad Gateway error. Conversely, for non-existent cluster IDs, the endpoint returns HTTP 200. This difference in response codes creates an observable response discrepancy, enabling an attacker to enumerate valid cluster IDs. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, limited confidentiality impact, and no integrity or availability impact.

An attacker can use the observable difference in HTTP response codes to enumerate valid cluster IDs in SUSE Rancher. This information disclosure could aid further targeted attacks. There is no direct impact on integrity or availability, and the confidentiality impact is limited to information disclosure of cluster existence.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor SUSE advisories for updates addressing this vulnerability.