Summary
CVE-2026-44946 is a SAML authentication replay vulnerability (CWE-294: Authentication Bypass by Capture-Replay) in SUSE Rancher Manager’s Assertion Consumer Service (ACS) handler. The ACS handler failed to enforce one-time use of SAML assertions, enabling an attacker who has captured a victim’s valid signed SAML response and corresponding pre-authentication state cookie to replay that assertion and open a separate authenticated session with the victim’s privileges. Rated 9.5 Critical under CVSS 4.0, successful exploitation can result in full authentication bypass and administrative account takeover across all Kubernetes clusters managed by the affected Rancher instance.
Technical details
- Root cause: Rancher’s ACS handler did not perform server-side tracking of SAML assertion IDs. Because the same signed SAML response could be submitted more than once without rejection, an attacker could re-use a captured assertion to obtain an independent authenticated session — a textbook capture-replay attack (CWE-294).
- Trigger conditions: Exploitation requires two prerequisites: (1) a valid, signed SAML response captured from a legitimate user’s authentication flow, and (2) the victim’s corresponding pre-authentication SAML state cookie. An attacker in a man-in-the-middle position or otherwise capable of intercepting HTTP/HTTPS traffic can satisfy both requirements.
- Attack vector: Network-accessible; no privileges and no user interaction are required. The vulnerability is present in any Rancher deployment with SAML authentication enabled, regardless of the identity provider — confirmed affected providers include Okta, Ping, ADFS, Keycloak, and Shibboleth.
- Impact: An attacker who successfully replays a SAML assertion establishes an authenticated Rancher session with the impersonated user’s permissions. If the captured assertion belongs to an administrator, the attacker gains full administrative control over Rancher and all downstream Kubernetes clusters it manages. CVSS 4.0 impact metrics reflect High confidentiality and integrity impact on both the vulnerable system and connected systems (VC:H, VI:H, SC:H, SI:H).
Affected software
- SUSE Rancher Manager 2.14.0 through 2.14.2
- SUSE Rancher Manager 2.13.0 through 2.13.6
- SUSE Rancher Manager 2.12.0 through 2.12.10
- SUSE Rancher Manager 2.11.0 through 2.11.14
Severity
CVSS 4.0 base score: 9.5 (Critical)
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
CVSS 3.1 base score: 7.4 (High)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Mitigation and recommended actions
- Immediate — upgrade to the patched release for your branch:
- Rancher v2.14.3 (for 2.14.x deployments)
- Rancher v2.13.7 (for 2.13.x deployments)
- Rancher v2.12.11 (for 2.12.x deployments)
- Rancher v2.11.15 (for 2.11.x deployments)
- If immediate patching is not feasible:
- Reduce SAML assertion validity windows at the Identity Provider to shrink the time window in which a captured assertion remains usable.
- Restrict network access to Rancher’s ACS endpoint so that only trusted clients can reach it.
- Enforce TLS between all clients and the Rancher server to impede man-in-the-middle interception of SAML assertions.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.