The /v3/import/{token}_{clusterId}.yaml endpoint retrieves a cluster object before validating the supplied token. When the specified cluster ID corresponds to a cluster that has private registry secrets, a nil pointer dereference in the system template package causes the server to return an HTTP 502 Bad Gateway. For non‑existent cluster IDs the same endpoint returns an HTTP 200 response. This discrepancy in status codes provides a reliable enumeration oracle that allows an unauthenticated attacker to determine which cluster IDs are valid and which are not, thereby revealing the existence of clusters that may contain sensitive registry information. The primary impact is the disclosure of cluster existence, which can assist attackers in planning further attacks, such as credential harvesting or lateral movement.

This vulnerability affects SUSE Rancher deployments that expose the public /v3/import/ endpoint. Version information is not specified, so any Rancher installation that supports the import token feature is potentially vulnerable. All clusters that possess private registry secrets are susceptible to the 502 error path, while clusters without such secrets or non‑existent cluster IDs pass through with a 200 status.

The CVSS score of 5.3 indicates moderate risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability can be exploited remotely through a simple HTTP request without authentication. An attacker can enumerate cluster IDs by observing response codes, a straightforward attack that requires no special credentials. The resulting information disclosure could aid further attacks against the cluster infrastructure.