CVE-2025-4940: SUSE Observability Rancher Extension Service Token Privilege Escalation

Summary of Key Vulnerability Information Vulnerability Overview Title: Privilege Escalation via Service Token in Rancher Extension CVE ID: CVE-2025-4940 Severity: Medium (CVSS v3.1 score: 5.7/10) Description: In SUSE Observability Rancher Extension, the service token used to access SUSE Observability is stored in a custom resource. Any user with read permissions on this resource can retrieve the service token and access Observability data. If the installation follows the documented procedure, the token can also be used to modify settings within SUSE Observability. Additionally, when the extension is uninstalled, the underlying resource is not deleted, leaving the service token accessible until the resource is manually removed. Affected Scope Affected Versions: >= 2.3.0, < 2.3.1 Fixed Version: 2.3.1 Impact: The default installation flow assigns the role to the namespace containing historical Observability and Health data, enabling management of monitors, dashboards, views, stacks, and notifications. Remediation 1. Temporary Mitigation: Immediately revoke the old service token and create a new one. When generating the replacement token, assign the role to the new token to enforce read-only access and the principle of least privilege. 2. Permanent Fix: Upgrade the SUSE Observability Rancher Extension to version 2.3.1 or later. The service token will be stored as a Kubernetes Secret within a managed namespace; when the extension is uninstalled, the namespace and its associated Secret are automatically removed. 3. Mitigation for Active Deployments: Mitigate the risk by revoking existing service tokens and utilizing least-privilege tokens. 4. Preventing Token Leakage: Prior to uninstalling the extension, the service token stored in the custom resource can be manually deleted, or the associated external SUSE Observability service token can be revoked or deleted (as referenced in the official documentation).

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-4940: SUSE Observability Rancher Extension Service Token Privilege Escalation

More from this source