Service token exposure and potential privilege escalation in SUSE Observability

published 2026-09-17 53 d ago modified 2026-09-29 40 d ago also EUVD-2026-81382

cvss: 5.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 12%
public exploits: 0; none known

The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather than managing them securely. An attacker with minimal access could obtain the token to gain unauthorized access or escalate privileges within the observability environment.

Patch / fix

fixed in 1

SUSE SUSE Observability 2.13.6, 2.14.2

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 52 d ago (2026-09-17)

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Affected products

SUSE SUSE Observability

Classification

Weakness

CWE-312 Cleartext Storage of Sensitive Information
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

CVE List CVE-2026-44940
NVD CVE-2026-44940

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary