The vulnerability in SUSE Rancher involves the /v3/import/{token}_{clusterId}.yaml endpoint which fetches the cluster object prior to token validation. When a valid cluster ID corresponds to a cluster configured with private registry secrets, a nil pointer dereference in the code (pkg/systemtemplate/private_registry.go) causes the server to respond with HTTP 502 Bad Gateway. Conversely, requests with non-existent cluster IDs return HTTP 200 OK. This difference in observable responses creates an enumeration oracle, enabling an attacker to distinguish valid cluster IDs from invalid ones. The CVSS 3.1 score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact.

The vulnerability allows an attacker to reliably enumerate valid cluster IDs by observing the difference in HTTP response codes. There is no direct impact on integrity or availability beyond the 502 error, and confidentiality impact is limited to information disclosure of cluster existence. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor SUSE's advisories for updates addressing this issue.