Which versions of Rancher AI Agent are affected by CVE-2026-44934?

SUSE Rancher AI Agent 1.0 has a vulnerability that allows exposed API credentials and confidential AI model outputs to be read from log files when debug logging is enabled.. A patch is available.

How to fix or mitigate CVE-2026-44934?

Within 24 hours: Identify all systems running SUSE Rancher AI Agent 1.0 and verify whether DEBUG loglevel is enabled; disable it in all production environments immediately. Within 7 days: Restrict file access to log directories through operating system-level permissions, limiting readers to essential system accounts only; establish baseline of who currently has access. Within 30 days: Monitor vendor advisories for patch availability and develop migration/upgrade plan for when updates become available.

Rancher AI Agent CVE-2026-44934

Q: What is the CVSS score of CVE-2026-44934?

CVE-2026-44934 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-41858 HIGH

Insertion of Sensitive Information Into Debugging Code (CWE-215)

2026-07-06 suse

Information Disclosure Rancher Suse

7.0

CVSS 4.0 · Vendor: suse

Severity by source

Vendor (suse) PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.0 MEDIUM

Local log access and privileged, DEBUG-dependent configuration justify AV:L/PR:H; leaked API keys impact other systems so S:C, and the flaw only discloses data (C:H, I:N, A:N).

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 06, 2026 - 10:01 EUVD

Analysis Generated

Jul 06, 2026 - 09:19 vuln.today

DescriptionCVE.org

A information disclosure when DEBUG loglevel is set in SUSE Rancher AI Agent 1.0 before 1.0.2 could leak API keys or LLM response text with potential sensitive data into logfiles, allowing local attackers to misuse respective gained data or credentials.

AnalysisAI

Information disclosure in SUSE Rancher AI Agent 1.0 before 1.0.2 writes API keys and raw LLM response text (which may contain sensitive data) into logfiles when the DEBUG loglevel is enabled, letting a local attacker with access to those logs harvest credentials and confidential model output. Rated CVSS 4.0 base 7.0, the flaw requires local access and high privileges plus a non-default debug configuration. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Rancher AI Agent is a SUSE add-on that brokers requests between Rancher/Kubernetes management workflows and a backing Large Language Model, using API keys to authenticate to the LLM service. The root cause is classed as CWE-215 (Insertion of Sensitive Information Into Debug/Log Files): when the application's loglevel is set to DEBUG, the verbose logging path emits secrets - the LLM provider API keys and the full response payloads - into persistent logfiles rather than redacting them. Because the leaked material is both an authentication credential and potentially sensitive business/user data returned by the model, exposure of the log store effectively exposes downstream systems the credential unlocks. The CPE reported (cpe:2.3:a:suse:rancher) is the generic Rancher entry; the actual affected component is the Rancher AI Agent 1.0.x line.

RemediationAI

Upgrade to SUSE Rancher AI Agent 1.0.2 or later, which is the vendor-released patch (Vendor-released patch: 1.0.2), and consult the advisory at https://github.com/rancher/rancher-ai-agent/security/advisories/GHSA-5r2r-h824-fr5v. As an immediate compensating control until patched, set the agent's loglevel away from DEBUG (use INFO or higher) so secrets are no longer written - the trade-off is reduced diagnostic detail for troubleshooting. Additionally, restrict read access to existing logfiles and any centralized log aggregation store, purge or rotate historical logs that may already contain leaked keys, and rotate/revoke any LLM API keys that were logged while DEBUG was active, since the exposed credential remains valid until rotated.