This vulnerability involves the insertion of sensitive information into debugging code in SUSE Rancher AI Agent versions 1.0.0 through 1.0.1. Specifically, when the DEBUG log level is set, API keys and LLM response text that may contain sensitive data are logged, leading to potential information disclosure. The issue affects local attackers who can access the log files and exploit the leaked credentials or data. The CVSS 4.0 vector indicates a local attack vector with high confidentiality impact and partial attack complexity. No vendor advisory or patch is currently available, and the product is not a cloud service, so remediation must be managed by the user.

Sensitive information such as API keys and potentially sensitive response data from the AI agent may be exposed in log files when DEBUG logging is enabled. This exposure could allow local attackers to gain unauthorized access or misuse credentials, leading to potential compromise of related systems or data. The impact is limited to local attackers with access to the affected system and log files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid enabling DEBUG log level in SUSE Rancher AI Agent versions 1.0.0 through 1.0.1 to prevent sensitive information from being logged. Restrict local access to log files to trusted users only.