CVE-2026-44940: SUSE Observability Rancher Extension service token exposure

CVE-2026-44940 · Severity: medium · CVSS 5.7 · Published 2026-09-17

The rancher-extension-stackstate extension in SUSE Observability stores authentication tokens in an insecure configuration location accessible to any user with basic Kubernetes permissions. An attacker could retrieve these tokens to gain unauthorized access to observability data and modify monitoring configurations, dashboards, and alerts. Organizations may suffer data exposure, loss of visibility into infrastructure, and unauthorized changes to critical monitoring settings.

Vendors: Suse.

Quick answers

Is CVE-2026-44940 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44940 being exploited in the wild.
How severe is CVE-2026-44940?
Medium severity, with a CVSS score of 5.7, published 17 September 2026.
Which products and versions are affected?
Suse Observability Rancher Extension >=2.3.0, <2.3.1.
Is there a fix for CVE-2026-44940?
A patch was published on 2026-05-27: Patch available in version 2.3.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44940 attacked?
It is attacked over the network.
Am I affected by CVE-2026-44940?
Check whether you run Suse Observability Rancher Extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a credential exposure issue in the rancher-extension-stackstate extension. Service tokens required to authenticate with SUSE Observability are stored in plain text within a Kubernetes Configuration custom resource, rather than in a protected Secret object. An attacker with read permissions on Configuration resources (a common permission in multi-tenant clusters) can retrieve the token and use it to access observability data and modify settings. By default, the token carries permissions matching the stackstate-k8s-troubleshooter role, which grants broad access including dashboard management and data modification. The issue persists even after extension uninstallation, as the Configuration resource is not automatically cleaned up. Patch version 2.3.1 addresses this by moving tokens to Kubernetes Secrets in a managed namespace with automatic cleanup on uninstall.

Affected products

  • SUSE Observability Rancher Extension >=2.3.0, <2.3.1

Timeline

  • 2026-05-27: disclosed: Published on GitHub Security Advisory
  • 2026-09-17: advisory: Published on NVD
  • 2026-05-27: patched: Patch available in version 2.3.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.