CVE-2026-44946: 
Rancher vulnerability analysis and mitigation

CVE-2026-44946 is a SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler that fails to enforce one-time use of SAML assertions, potentially enabling person-in-the-middle (AiTM) attacks. The vulnerability affects SUSE Rancher versions 2.11.0–2.11.14, 2.12.0–2.12.10, 2.13.0–2.13.6, and 2.14.0–2.14.2. It was published on June 30, 2026, and was responsibly disclosed by Austin Chu, Sohee Kim, and Corban Villa as part of a U.C. Berkeley security research project. The vulnerability carries a CVSS v3.1 base score of 7.4 (High) and a CVSS v4.0 base score of 9.5 (Critical) (GitHub Advisory, Feedly).

The root cause is classified as CWE-294 (Authentication Bypass by Capture-replay): Rancher's shared ACS handler (pkg/auth/providers/saml/saml_client.go) did not track previously processed SAML assertion IDs, allowing the same signed SAML response to be submitted multiple times to obtain separate authenticated sessions. All SAML-based authentication providers supported by Rancher — including Okta, Ping, ADFS, Keycloak, and Shibboleth — share this handler and are therefore equally affected. Exploitation requires three preconditions: (1) Rancher must be configured with a SAML-based authentication provider, (2) the attacker must obtain a valid signed SAML response from the victim's authentication flow (via network interception, log access, or another vulnerability such as XSS), and (3) the attacker must also obtain the victim's corresponding pre-authentication SAML state cookie. The fix introduces server-side tracking of assertion IDs in an in-memory cache keyed by the assertion's NotOnOrAfter time, and enforces strict validation of NotBefore/NotOnOrAfter time conditions (GitHub Advisory).

A successful replay attack allows an unauthenticated attacker to establish a new authenticated Rancher session as the victim, inheriting all permissions assigned to that account — including full administrative privileges where applicable. This enables complete impersonation of the affected user, with high confidentiality and integrity impact across the Rancher management plane and any downstream Kubernetes clusters it manages. Availability is not directly impacted, but unauthorized administrative access could facilitate cluster takeover, workload manipulation, secret exfiltration, or lateral movement into managed infrastructure (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of publication (Feedly). The EPSS score is approximately 0.316%, reflecting low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is rated "High" complexity due to the requirement to intercept a valid SAML response and the associated state cookie, making opportunistic mass exploitation unlikely without a privileged network position or a secondary vulnerability (GitHub Advisory).

1. Reconnaissance: Identify Rancher deployments configured with a SAML-based identity provider (Okta, Ping, ADFS, Keycloak, or Shibboleth) using network scanning or service enumeration.
2. Position for interception: Establish a man-in-the-middle position on the network path between the victim's browser and the Rancher ACS endpoint, or identify an alternative means of obtaining a SAML response (e.g., access to application logs, a secondary XSS vulnerability).
3. Capture SAML artifacts: Intercept the victim's SAML authentication flow to capture both the signed SAML response (HTTP POST to the ACS endpoint) and the pre-authentication SAML state cookie set by Rancher.
4. Replay the SAML response: Submit the captured SAML response along with the associated state cookie to Rancher's ACS endpoint (/v1-saml/<provider>/saml/acs) in a new HTTP POST request.
5. Obtain authenticated session: Rancher processes the replayed assertion without checking for prior use, issuing a new authenticated session token with the victim's full privileges.
6. Leverage access: Use the forged session to access Rancher's management interface, enumerate or modify Kubernetes clusters, extract secrets, or escalate privileges further (GitHub Advisory).

• Network: Multiple HTTP POST requests to the Rancher SAML ACS endpoint (e.g., /v1-saml/<provider>/saml/acs) containing identical SAML assertion IDs within a short time window; requests originating from different source IPs using the same SAML response body.
• Logs: Rancher authentication logs showing successful logins for a user account from unexpected IP addresses or geographic locations shortly after a legitimate login event; duplicate SAML assertion IDs appearing in authentication audit logs.
• Session Behavior: Multiple concurrent active sessions for the same user account established within a short timeframe; session tokens issued to IP addresses inconsistent with the user's normal access patterns.
• Application: Unexpected administrative actions (cluster modifications, secret access, RBAC changes) performed under a legitimate user's account that do not align with that user's normal activity (GitHub Advisory).

Upgrade Rancher to one of the patched versions: 2.14.3, 2.13.7, 2.12.11, or 2.11.15, which introduce server-side assertion ID tracking and strict NotBefore/NotOnOrAfter time validation in the shared ACS handler. There is no complete workaround for users who cannot upgrade immediately. As partial mitigations, reduce the SAML assertion validity window at the Identity Provider level to minimize the replay window, enforce TLS with certificate validation between clients and Rancher to reduce interception feasibility, and restrict network access to the Rancher SAML ACS endpoint to trusted sources (GitHub Advisory).

The vulnerability was responsibly disclosed by researchers Austin Chu, Sohee Kim, and Corban Villa from U.C. Berkeley, and SUSE's Rancher security team coordinated the fix and advisory publication. The advisory was noted across vulnerability tracking platforms including VulnDB, Vulners, and CIRCL shortly after publication. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been observed at this time (GitHub Advisory).