CVE-2026-44934

A information disclosure when DEBUG loglevel is set in SUSE Rancher AI Agent 1.0 before 1.0.2 could leak API keys or LLM response text with potential sensitive data into logfiles, allowing local attackers to misuse respective gained data or credentials.

CVSS

No CVSS.

References

Link	Resource
https://github.com/rancher/rancher-ai-agent/security/advisories/GHSA-5r2r-h824-fr5v

Configurations

No configuration.

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Una revelación de información cuando el nivel de registro DEBUG está configurado en SUSE Rancher AI Agent 1.0 anterior a 1.0.2 podría filtrar claves de API o texto de respuesta de LLM con datos potencialmente sensibles en los archivos de registro, permitiendo a atacantes locales hacer un uso indebido de los datos o credenciales obtenidos.

Information

Published : 2026-07-06 09:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-44934

Mitre link : CVE-2026-44934

CVE.ORG link : CVE-2026-44934

JSON object : View

Products Affected

No product.

CWE

CWE-215

Insertion of Sensitive Information Into Debugging Code

{"id": "CVE-2026-44934", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44934", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T18:53:12.072112Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "meissner@suse.de", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.0, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "meissner@suse.de", "affectedData": [{"repo": "https://github.com/rancher/rancher-ai-agent", "vendor": "SUSE", "product": "Rancher", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.0.2", "versionType": "semver"}], "packageName": "Rancher AI Agent", "defaultStatus": "unaffected"}]}], "published": "2026-07-06T09:16:36.170", "references": [{"url": "https://github.com/rancher/rancher-ai-agent/security/advisories/GHSA-5r2r-h824-fr5v", "source": "meissner@suse.de"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "meissner@suse.de", "description": [{"lang": "en", "value": "CWE-215"}]}], "descriptions": [{"lang": "en", "value": "A information disclosure when DEBUG loglevel is set in SUSE Rancher AI Agent 1.0 before 1.0.2 could leak API keys or LLM response text with potential sensitive data into logfiles, allowing local attackers to misuse respective gained data or credentials."}, {"lang": "es", "value": "Una revelaci\u00f3n de informaci\u00f3n cuando el nivel de registro DEBUG est\u00e1 configurado en SUSE Rancher AI Agent 1.0 anterior a 1.0.2 podr\u00eda filtrar claves de API o texto de respuesta de LLM con datos potencialmente sensibles en los archivos de registro, permitiendo a atacantes locales hacer un uso indebido de los datos o credenciales obtenidos."}], "lastModified": "2026-10-25T15:10:00.147", "sourceIdentifier": "meissner@suse.de"}