CVE-2026-44940— Service token exposure and potential privilege escalation in SUSE Observability

Quick assessment

Affected

SUSE SUSE Observability

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SUSE Observability 中的扩展未在安全的存储位置以明文形式暴露服务令牌。拥有有限权限的攻击者可能获取该令牌，从而在可观测性环境中获得未授权的访问权限或提升自身权限。

CVSS 5.7 · Medium EPSS 0.22% · P12 Updated Sep 30, 2026

Possible ATT&CK Techniques 1 AI

T1552.006 · Group Policy Preferences

Affected Version Matrix 2

Vendor	Product	Version Range	Status
SUSE	SUSE Observability	`< 2.13.6`	affected
		`2.14.0< 2.14.2`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Service token exposure and potential privilege escalation in SUSE Observability

Source: CVE Program / CVE List V5

Vulnerability Description

The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather than managing them securely. An attacker with minimal access could obtain the token to gain unauthorized access or escalate privileges within the observability environment.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

敏感数据的明文存储

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
SUSE	SUSE Observability	0 ~ 2.13.6	-

II. Public POCs for CVE-2026-44940

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-44940

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-44940 (2)

https://www.cve.org/CVERecord?id=CVE-2026-44940

Same Patch Batch · SUSE · 2026-09-17 · 5 CVEs total

CVE-2026-78428	8.8 HIGH	Flaw in Neuvector can result in one user receiving another user's authenticated session wh
CVE-2026-78425	7.6 HIGH	SAML Audience Confusion Allows Cross-SP Authentication
CVE-2026-78427	5.3 MEDIUM	Admission Control Bypass via Hardcoded Sidecar Image Exemption
CVE-2026-78426	2.0 LOW	Logout bypass via alternate JWT spelling

IV. Related Vulnerabilities

Same vendor: SUSE

Same weakness: CWE-312