CVE-2026-44946: SAML Authentication Replay in Rancher

Synopsis

A SAML authentication replay vulnerability affects Rancher's Assertion Consumer Service (ACS) handler, which processes login assertions from identity providers. The flaw is reachable over the network without any authentication, though exploiting it requires a person-in-the-middle position and specific preconditions (CVSS AC:H, AT:P). A successful attacker can replay a captured SAML assertion to authenticate as the targeted user, gaining full access to Rancher with that user's privileges and potentially affecting downstream systems Rancher manages. Patched-image rebuilds at versions 2.11.15, 2.12.11, 2.13.7, and 2.14.3 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The Rancher ACS endpoint is exposed over the network, so an attacker must be able to reach it and intercept traffic between the identity provider and Rancher.

• AuthenticationNot required

  No credentials are required to submit a replayed SAML assertion to the ACS handler; the vulnerability lies in the handler accepting the assertion without verifying one-time use.

• Victim interactionNot required

  The attacker replays a previously captured assertion without requiring any action from the legitimate user at the time of the attack.

• Attack complexityDetail

  Exploitation requires a person-in-the-middle position and specific preconditions (AT:P) to capture a valid SAML assertion, making reliable exploitation dependent on environmental factors rather than a simple, condition-free technique.

Blast Radius

• Attacker authenticates to Rancher as the user whose SAML assertion was captured, reading any data that user can access including cluster configurations, secrets, and workload definitions.
• Attacker can create, modify, or delete Kubernetes workloads and cluster resources within the scope of the replayed user's role.
• Downstream systems and clusters managed by Rancher are reachable from the attacker's session, expanding the scope of tampering and credential theft beyond the Rancher management plane itself.
• Scope impact is high on both the vulnerable system and downstream systems (SC:H, SI:H, SA:H), meaning a compromised Rancher admin session exposes every managed cluster to disruption or reconfiguration.