CVE-2026-44946: SAML Assertion Replay Vulnerability in SUSE Rancher 2.14.0–2.14.2

Technical summary

CVE-2026-44946 is a SAML assertion replay vulnerability in Rancher's ACS endpoint. The vulnerability stems from inadequate validation of assertion freshness and consumption state. SAML assertions contain cryptographic signatures and timestamps; the one-time-use principle requires that once an assertion has been consumed in an authentication transaction, the same assertion cannot be accepted again, even if all signatures validate correctly. Rancher's ACS handler does not properly track or enforce this constraint, enabling an attacker with network visibility (such as a compromised network segment or rogue proxy) to capture an assertion and submit it again to establish a new authenticated session. The vulnerability requires the attacker to have network access to intercept or redirect SAML flows, placing it at the intersection of authentication bypass and replay attacks (CWE-294: Improper Validation of Specified Quantity in Input).

Business impact

Successful exploitation allows attackers to hijack user sessions without knowledge of passwords or multi-factor authentication secrets. In environments where SAML is federated across multiple applications, a single compromised assertion could be replayed against Rancher and potentially other integrated services. This directly undermines identity assurance and could lead to unauthorized access to infrastructure management functions within Rancher, cluster administration, and workload deployment. For organizations relying on Rancher for multi-tenant Kubernetes management, this creates privilege escalation and lateral movement risks.

Affected systems

SUSE Rancher versions 2.14.0, 2.14.1, and 2.14.2 are affected. The vulnerability is resolved in Rancher 2.14.3 and later. Organizations should verify their current Rancher version and check the official SUSE Rancher security advisory for definitive patch availability across all supported branches and distributions.

Exploitability

Exploitation requires network-level access to observe or intercept SAML authentication traffic—typically not achievable from the public internet unless the SAML endpoint is directly exposed or an attacker has compromised network infrastructure on the path between the client and Rancher. The vulnerability does not require user interaction and does not need elevated privileges to trigger. The CVSS score of 7.4 (HIGH) reflects high confidentiality and integrity impact but assumes an attacker can actively participate in network communications, placing the attack complexity at 'High.' This is not a trivial worm-like vector, but organizations with exposed Rancher instances or weakly segmented networks face meaningful risk.

Remediation

Upgrade SUSE Rancher to version 2.14.3 or later. Organizations on versions 2.14.0–2.14.2 should treat this as a priority patching target. Verify patch deployment by confirming Rancher version post-upgrade. Until patching is complete, network isolation and strict access control to the SAML ACS endpoint can reduce exposure. Consult the official SUSE Rancher security advisory for detailed upgrade paths and any version-specific considerations.

Patch guidance

Apply Rancher 2.14.3 or any subsequent release. If your organization is on an extended support branch, verify the corresponding patched version through the SUSE Rancher release notes. Test the upgrade in a non-production environment first to ensure no breaking changes or configuration conflicts. Pay particular attention to SAML configuration after patching to confirm IdP trust and assertion mappings remain intact. Document the patch application date and version for compliance and incident response records.

Detection guidance

Monitor SAML authentication logs for suspicious patterns: multiple successful authentications from the same assertion ID within a short time window, repeated login events from the same user with identical assertion timestamps, or authentication attempts with assertions bearing old creation times (timestamp validation). Network-based detection is challenging but possible via examining SAML POST request payloads for duplicate assertion IDs or by correlating authentication flows with session establishment times. Enable verbose logging on the SAML IdP and Rancher side to track assertion reuse. Host-based monitoring should alert on multiple concurrent session initiations from the same source IP bearing the same or very similar assertion identifiers.

Why prioritize this

Although not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, the vulnerability carries a HIGH CVSS score (7.4) due to direct impact on authentication and authorization—core security functions. The threat is particularly acute for organizations that expose Rancher on partially trusted networks or rely on SAML as their primary authentication mechanism. Rancher's role as an infrastructure management platform means compromised sessions could affect large numbers of workloads and clusters. The three-patch sequence (2.14.0, 2.14.1, 2.14.2 all vulnerable) suggests the issue was not caught in initial release, increasing the likelihood of wide deployment. Prioritize patching for production Rancher instances, especially those in multi-tenant or internet-facing environments.

Risk score, explained

The CVSS 3.1 score of 7.4 reflects an attack vector that is network-accessible (AV:N) but requires the attacker to have an advantageous position to intercept or observe SAML traffic (AC:H). The confidentiality and integrity impacts are rated High (C:H, I:H) because successful replay leads to unauthorized session hijacking and potential lateral movement. Availability is not affected (A:N), as the attack does not disrupt service. The score is not in the CRITICAL range (9.0+) because exploitation is not trivially remote and unauthenticated; it requires either compromised network position or a misconfigured, publicly exposed SAML endpoint. However, it remains HIGH and warrants urgent remediation in production environments.

Frequently asked questions