EUVD-2026-81382Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Cleartext token in config/insecure storage is read locally by a low-priv actor (AV:L/PR:L), no user interaction, confidentiality-only impact (C:H, I:N/A:N); escalation is downstream token reuse, not base impact.
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
Lifecycle Timeline
4DescriptionCVE.org
The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather than managing them securely. An attacker with minimal access could obtain the token to gain unauthorized access or escalate privileges within the observability environment.
AnalysisAI
SUSE Observability deployments using the rancher-extension-stackstate extension are susceptible to credential exposure where service tokens are stored insecurely, enabling an attacker with local access and low privileges to obtain them and potentially escalate privileges. This moderate-severity issue (CWE-312) requires pre-existing minimal access to the affected system and has a confidentiality-only impact, with no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the rancher-extension-stackstate extension deployed within SUSE Observability, where service tokens are written to plain configuration files or otherwise insecurely stored. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity credential-exposure issue, not a high-priority emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is specified in the provided data; consult the SUSE Bugzilla (https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44940) and GitHub advisory (https://github.com/StackVista/rancher-extension-stackstate/security/advisories/GHSA-7c27-jc6w-pw95) for updated remediation guidance, which may include upgrading to a patched extension release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role
A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network
Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. Rated critical severity (CVSS 9
A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by cr
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, a
Stored cross-site scripting in the SUSE Rancher UI allows unauthenticated remote attackers to inject malicious script th
Command injection in Rancher Manager’s cluster import endpoint enables remote attackers to deploy malicious containers o
SAML assertion replay in Rancher's Assertion Consumer Service (ACS) handler lets a person-in-the-middle who captures a v
Privilege escalation in SUSE Rancher (Kubernetes management platform) allows a user holding the Project Owner role to im
Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. Rated
Privilege escalation in Rancher 2.13 (before 2.13.6) and 2.14 (before 2.14.2) lets any authenticated user gain principal
Privilege escalation in SUSE Rancher Fleet (0.14.x before 0.14.11, 0.15.x before 0.15.7, and 0.16.x before 0.16.2) lets
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today