CVE-2026-75034
Undergoing Analysis Undergoing Analysis - In Progress

SAML Assertion Replay in Rancher Manager

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: SUSE

Description
A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a captured assertion could replay it once against every other replica to obtain additional authenticated sessions as the victim. This issue affects Rancher: before 2.15.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-75034
EUVD
EUVD-2026-70512

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rancher rancher to 2.15.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-294 A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Rancher Manager where SAML assertion replay protection only works per pod in high-availability setups. An attacker could capture a valid SAML assertion and replay it against different pods to gain unauthorized authenticated sessions as the victim.

Detection Guidance

This vulnerability affects Rancher Manager versions before 2.15.1 and involves SAML assertion replay attacks in high-availability deployments. To detect it, check Rancher Manager version with: kubectl get deployment rancher -n cattle-system -o jsonpath='{.spec.template.spec.containers[0].image}' and verify it is not below 2.15.1. Monitor authentication logs for repeated SAML assertions from the same user across multiple pods.

Impact Analysis

If you use Rancher in a high-availability deployment before version 2.15.1, an attacker could exploit this to gain unauthorized access to your system by replaying captured SAML assertions, potentially leading to data breaches or unauthorized actions.

Compliance Impact

This vulnerability could lead to unauthorized access, which may violate compliance requirements for data protection and access control in standards like GDPR and HIPAA. Unauthorized access risks data breaches and non-compliance with security controls.

Mitigation Strategies

Upgrade Rancher to version 2.15.1 or later to address the SAML assertion replay protection flaw affecting high-availability deployments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75034. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart