Suse Observability
Monthly
SUSE Observability deployments using the rancher-extension-stackstate extension are susceptible to credential exposure where service tokens are stored insecurely, enabling an attacker with local access and low privileges to obtain them and potentially escalate privileges. This moderate-severity issue (CWE-312) requires pre-existing minimal access to the affected system and has a confidentiality-only impact, with no public exploit identified at time of analysis. The assessed CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) underscores that exploitation is limited to environments where tokens are improperly stored.
SUSE Observability deployments using the rancher-extension-stackstate extension are susceptible to credential exposure where service tokens are stored insecurely, enabling an attacker with local access and low privileges to obtain them and potentially escalate privileges. This moderate-severity issue (CWE-312) requires pre-existing minimal access to the affected system and has a confidentiality-only impact, with no public exploit identified at time of analysis. The assessed CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) underscores that exploitation is limited to environments where tokens are improperly stored.