EUVD-2026-70512Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
UI:R because a victim must perform a SAML login to generate the capturable assertion; all other metrics align with the vendor vector.
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
Lifecycle Timeline
5DescriptionCVE.org
A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a captured assertion could replay it once against every other replica to obtain additional authenticated sessions as the victim.
This issue affects Rancher: before 2.15.1.
AnalysisAI
SAML assertion replay bypass in Rancher Manager before v2.15.1 allows unauthenticated network attackers to obtain additional authenticated management sessions as a victim user in high-availability deployments. The per-process in-memory cache that tracks consumed SAML assertion IDs - introduced by the CVE-2026-44946 fix - is not shared across pod replicas, so a captured assertion can be replayed once against each replica that has not yet seen it, yielding one unauthorized session per targeted replica. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires Rancher Manager deployed in high-availability mode with two or more replicas behind a load balancer - single-replica deployments are not affected by the cross-replica replay pattern. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.4 score (AV:N/AC:H/PR:N/UI:N) reflects the non-trivial prerequisite of first capturing a valid SAML assertion - the AC:H rating accurately captures this complexity, as assertion capture typically requires network-level interception of the SAML redirect or POST binding, or a companion vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Rancher Manager to v2.15.1 or later, which modifies the SAML assertion replay tracking to synchronize consumed assertion IDs across all replicas rather than maintaining separate per-process caches. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Rancher Manager deployments and identify versions prior to v2.15.1, with priority on high-availability configurations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role
A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network
Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. Rated critical severity (CVSS 9
A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by cr
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, a
Command injection in Rancher Manager’s cluster import endpoint enables remote attackers to deploy malicious containers o
SAML assertion replay in Rancher's Assertion Consumer Service (ACS) handler lets a person-in-the-middle who captures a v
Privilege escalation in SUSE Rancher (Kubernetes management platform) allows a user holding the Project Owner role to im
Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. Rated
Privilege escalation in Rancher 2.13 (before 2.13.6) and 2.14 (before 2.14.2) lets any authenticated user gain principal
Cleartext registration token exposure in Rancher allows a low-privileged user to obtain perpetually valid cluster join t
A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today