What is CVE-2026-44940?

CVE-2026-44940 is a medium-severity vulnerability in SUSE Observability, classified under Information Disclosure. CVSS score: 5.7/10. Published 2026-09-17.

How severe is CVE-2026-44940?

Medium severity. CVSS v3 base score is 5.7 out of 10.

Information disclosure in SUSE Observability

CVE-2026-44940

The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather than managing them securely. An attacker with minimal access could obtain the token to gain unauthorized access or escalate privileges within the observability environment.

Vulnerability class: Information Disclosure

CVSS v3 metric

CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N.

Affected products

Suse Observability

Weakness classification (CWE)

CWE-200 — Information Disclosure
CWE-312 — Cleartext Storage of Sensitive Information

References

meissner@suse.de
meissner@suse.de

Frequently asked questions

What is CVE-2026-44940?: CVE-2026-44940 is a medium-severity vulnerability in SUSE Observability, classified under Information Disclosure. CVSS score: 5.7/10. Published 2026-09-17.
How severe is CVE-2026-44940?: Medium severity. CVSS v3 base score is 5.7 out of 10.