# CVE-2026-75034: Rancher Manager SAML assertion replay protection bypass

Source: https://junglewise.ai/threats/cve-2026-75034-rancher-manager-saml-assertion-replay-protection-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75034 · Severity: high · CVSS 7.4 · Published 2026-09-03

Rancher Manager is a Kubernetes cluster management platform that uses SAML for federated authentication. A flaw in SAML assertion replay protection allows an attacker with a captured authentication token to replay it multiple times across different server replicas in a high-availability setup, creating additional authenticated sessions as the victim without needing the victim's actual credentials.

Technologies: [Suse Rancher](https://junglewise.ai/threats/technologies/rancher). Vendors: [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-2026-75034 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75034 being exploited in the wild.

**How severe is CVE-2026-75034?** High severity, with a CVSS score of 7.4, published 3 September 2026.

**Which products and versions are affected?** Rancher Manager before 2.15.1.

**Is there a fix for CVE-2026-75034?** A patch was published on 2026-08-28: Fixed in v2.15.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75034 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-75034?** Check whether you run Suse Rancher. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a replay attack in the SAML authentication handler. The fix for CVE-2026-44946 introduced assertion replay protection, but it tracked consumed assertion IDs only in a per-process, in-memory cache. In multi-replica deployments, each replica maintains a separate cache, so an attacker with a valid SAML assertion can replay it against multiple replicas to obtain additional authenticated sessions. The attack requires network access to the SAML endpoint and a previously captured valid SAML assertion, but no authentication credentials. The fix validates assertion IDs across all replicas to prevent cross-replica replay attacks. This affects all SAML providers integrated with Rancher.

## Affected products

- Rancher Manager before 2.15.1

## Timeline

- 2026-09-03: disclosed
- 2026-08-28: patched: Fixed in v2.15.1

## References

- [https://github.com/rancher/rancher/releases/tag/v2.15.1](https://github.com/rancher/rancher/releases/tag/v2.15.1)

## Related threats

- [SUSE Rancher privilege escalation in GlobalRole RBAC](https://junglewise.ai/threats/cve-2026-88810-a-privilege-escalation-issue-was-discovered-in-rancher-manager-s)
- [Rancher privilege escalation via project name collision](https://junglewise.ai/threats/cve-2024-22031-rancher-users-who-can-create-projects-can-gain-access-to)
- [SUSE Rancher Fleet privilege escalation in resource deployment](https://junglewise.ai/threats/cve-2026-88808-a-vulnerability-has-been-identified-within-rancher-manager-where)
- [SUSE Rancher session revocation bypass on logout](https://junglewise.ai/threats/cve-2026-88805-incorrect-credential-cleaning-on-logout-could-be-used-by-remote)
- [SUSE Rancher stored cross-site scripting in public UI settings](https://junglewise.ai/threats/cve-2026-88804-an-unauthenticated-update-of-public-ui-settings-could-be-used-by)