CVE-2026-75034: 
Rancher vulnerability analysis and mitigation

CVE-2026-75034 is a SAML assertion replay vulnerability in SUSE Rancher Manager affecting all versions before 2.15.1. The flaw stems from an incomplete fix for a prior SAML replay issue (CVE-2026-44946): the replacement protection stored consumed assertion IDs in a per-process, in-memory cache, meaning each replica in a high-availability (HA) deployment maintained its own independent record. An attacker who captures a valid SAML assertion can replay it once against every other replica in the cluster, obtaining additional authenticated sessions as the victim user. It was published on September 3, 2026, and carries a CVSS v3.1 base score of 7.4 (High) (Rancher Release).

The root cause is classified as CWE-294 (Authentication Bypass by Capture-Replay). The prior fix for CVE-2026-44946 introduced assertion ID tracking to prevent SAML replay attacks, but stored those IDs only in each pod's local memory rather than a shared, cluster-wide store. In a multi-replica HA deployment, a captured SAML assertion that has been consumed by one pod is still considered fresh by all other pods, since they have no knowledge of the prior consumption. An attacker with a captured assertion (e.g., obtained via network interception or a compromised IdP session) can submit it to each remaining replica exactly once, generating one new authenticated session per replica. No authentication credentials are required beyond possession of the captured assertion, though the attack complexity is rated High due to the prerequisite of capturing a valid assertion (Rancher Release).

Successful exploitation allows an unauthenticated attacker (who possesses a captured SAML assertion) to create multiple authenticated sessions as the victim user across all Rancher replicas, resulting in high confidentiality and integrity impact. The attacker gains full access to whatever resources and permissions the victim user holds within Rancher, which may include management of downstream Kubernetes clusters, secrets, and workloads. All SAML authentication providers configured in Rancher are affected. Availability is not directly impacted by this vulnerability (Rancher Release).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of publication. The EPSS score is approximately 0.197%, indicating a low near-term exploitation probability. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the prerequisite of first capturing a valid SAML assertion. CVE-2026-75034 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog (Rancher Release).

1. Capture a SAML Assertion: Position to intercept a SAML authentication flow targeting a Rancher HA deployment — for example, via an adversary-in-the-middle attack on an unencrypted or improperly validated SAML binding, or by compromising a browser session to extract the assertion from a POST request.
2. Identify Rancher Replicas: Enumerate the IP addresses or hostnames of individual Rancher pod replicas in the HA deployment (e.g., via DNS, load balancer configuration, or internal network scanning).
3. Replay the Assertion Against Each Replica: Submit the captured SAML assertion directly to each replica's SAML assertion consumer endpoint (bypassing the load balancer to target pods individually), one replay per replica. Each pod's local cache has no record of the assertion being consumed, so each accepts it as valid.
4. Obtain Authenticated Sessions: Each successful replay returns an authenticated session token for the victim user. The attacker now holds multiple valid sessions with the victim's permissions across all Rancher replicas.
5. Leverage Access: Use the obtained sessions to access Rancher-managed Kubernetes clusters, secrets, workloads, or perform further privilege escalation depending on the victim's role (Rancher Release).

• Network: Multiple SAML assertion consumer service (ACS) requests from the same source IP or with the same assertion ID directed at different Rancher pod endpoints within a short time window; direct connections to individual Rancher pod IPs rather than through the load balancer.
• Logs: Rancher authentication logs showing the same SAML assertion ID accepted by more than one replica; multiple successful SAML login events for the same user from different pod instances in rapid succession.
• Session Activity: Simultaneous active sessions for the same user originating from different Rancher replicas or unexpected IP addresses; unusual API activity under a legitimate user account shortly after a SAML authentication event.

Upgrade Rancher to version 2.15.1 or later, which fixes the vulnerability by tracking consumed SAML assertion IDs in a shared, cross-replica store rather than per-process memory. No configuration-based workaround is available for HA deployments; the only effective remediation is upgrading. Organizations unable to upgrade immediately should consider temporarily reducing Rancher to a single replica (eliminating the cross-replica replay window) and monitoring SAML authentication logs for anomalous replay patterns (Rancher Release).