Executive brief
The rancher-extension-stackstate extension in SUSE Observability stores authentication tokens in an insecure configuration location accessible to any user with basic Kubernetes permissions. An attacker could retrieve these tokens to gain unauthorized access to observability data and modify monitoring configurations, dashboards, and alerts. Organizations may suffer data exposure, loss of visibility into infrastructure, and unauthorized changes to critical monitoring settings.
Technical details
The vulnerability is a credential exposure issue in the rancher-extension-stackstate extension. Service tokens required to authenticate with SUSE Observability are stored in plain text within a Kubernetes Configuration custom resource, rather than in a protected Secret object. An attacker with read permissions on Configuration resources (a common permission in multi-tenant clusters) can retrieve the token and use it to access observability data and modify settings. By default, the token carries permissions matching the stackstate-k8s-troubleshooter role, which grants broad access including dashboard management and data modification. The issue persists even after extension uninstallation, as the Configuration resource is not automatically cleaned up. Patch version 2.3.1 addresses this by moving tokens to Kubernetes Secrets in a managed namespace with automatic cleanup on uninstall.
Affected products
- SUSE Observability Rancher Extension >=2.3.0, <2.3.1
Timeline
- 2026-05-27: disclosed: Published on GitHub Security Advisory
- 2026-09-17: advisory: Published on NVD
- 2026-05-27: patched: Patch available in version 2.3.1