Executive brief
Rancher Manager is a Kubernetes cluster management platform that uses SAML for federated authentication. A flaw in SAML assertion replay protection allows an attacker with a captured authentication token to replay it multiple times across different server replicas in a high-availability setup, creating additional authenticated sessions as the victim without needing the victim's actual credentials.
Technical details
The vulnerability is a replay attack in the SAML authentication handler. The fix for CVE-2026-44946 introduced assertion replay protection, but it tracked consumed assertion IDs only in a per-process, in-memory cache. In multi-replica deployments, each replica maintains a separate cache, so an attacker with a valid SAML assertion can replay it against multiple replicas to obtain additional authenticated sessions. The attack requires network access to the SAML endpoint and a previously captured valid SAML assertion, but no authentication credentials. The fix validates assertion IDs across all replicas to prevent cross-replica replay attacks. This affects all SAML providers integrated with Rancher.
Affected products
- Rancher Manager before 2.15.1
Timeline
- 2026-09-03: disclosed
- 2026-08-28: patched: Fixed in v2.15.1