CVE-2026-44940

5.7 mediumEPSS 0.2%

Medium (5.7). EPSS 0.2% chance of exploitation in the next 30 days.

The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather than managing them securely. An attacker with minimal access could obtain the token to gain unauthorized access or escalate privileges within the observability environment.

Severity

CVSS 3.1

5.7 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
CWEs: CWE-200, CWE-312
Published: 2026-09-17
Modified: 2026-09-29
Record from: the NVD, synced 2026-10-19

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44940
https://github.com/StackVista/rancher-extension-stackstate/security/advisories/GHSA-7c27-jc6w-pw95

Check your stack JSON