Skip to main content

Rancher EUVDEUVD-2026-40304

| CVE-2026-44946 CRITICAL
Authentication Bypass by Capture-replay (CWE-294)
2026-06-30 suse
Denial Of Service Rancher
9.5
CVSS 4.0 · Vendor: suse
Share

Severity by source

Vendor (suse) PRIMARY
9.5 CRITICAL
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.7 HIGH

Network-reachable but requires a MITM position to capture a live assertion (AC:H); no credentials to replay (PR:N); Rancher compromise cascades to managed clusters (S:C, C:H/I:H), with no direct availability impact (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Jun 30, 2026 - 14:01 EUVD
Analysis Generated
Jun 30, 2026 - 12:52 vuln.today

DescriptionCVE.org

A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler did not enforce one-time use of SAML assertion, potentially allowing person in the middle attacks against Rancher, affecting Rancher 2.14.0 before 2.14.3,

AnalysisAI

SAML assertion replay in Rancher's Assertion Consumer Service (ACS) handler lets a person-in-the-middle who captures a victim's SAML response reuse that assertion to authenticate as the victim, because the handler never enforces one-time use. Rancher 2.14.0 through 2.14.2 are affected, and because Rancher governs downstream Kubernetes clusters, a successful replay can yield administrative control. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain MITM position on SAML path
Delivery
Capture victim's signed SAML assertion
Exploit
Replay assertion to Rancher ACS endpoint
Execution
Authenticate as victim user
Persist
Assume administrative control of Rancher
Impact
Pivot to managed Kubernetes clusters
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that Rancher 2.14.0-2.14.2 is configured to use SAML single sign-on, and that the attacker can observe and replay a victim's valid SAML assertion - i.e. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Signals are mixed and should temper the headline 9.5. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker positioned as a person-in-the-middle on the network path between an administrator's browser and Rancher (or between Rancher and the IdP) captures the signed SAML response as the admin logs in. Because the ACS handler does not invalidate already-used assertions, the attacker replays the same assertion to the ACS endpoint and is authenticated as that administrator, then leverages Rancher's control plane to reach managed Kubernetes clusters. …
Remediation Vendor-released patch: upgrade to Rancher 2.14.3, which the version range ('2.14.0 before 2.14.3') confirms as the fixed release; follow the upgrade guidance in advisory https://github.com/rancher/rancher/security/advisories/GHSA-c5jm-xcmq-9j95. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: identify all Rancher deployments running versions 2.14.0, 2.14.1, or 2.14.2 with SAML authentication enabled. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Rancher

View all
CVE-2026-44939 CRITICAL
9.4 Jun 19

{token}_{clusterId}.yaml. CVSS 4.0 rates this 9.4 (Critical) with a scope-changing impact on subsequent systems, but no

CVE-2026-41052 CRITICAL
9.4 Jun 29

Privilege escalation in SUSE Rancher (Kubernetes management platform) allows a user holding the Project Owner role to im
CVE-2026-41053 HIGH
8.8 Jun 30

Privilege escalation in Rancher 2.13 (before 2.13.6) and 2.14 (before 2.14.2) lets any authenticated user gain principal
CVE-2025-67601 HIGH
8.3 Feb 25

A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the -ski
CVE-2026-44949 HIGH
7.0 Jun 30

Authentication bypass in SUSE Rancher's in-cluster admission webhook (rancher-webhook) lets a network-adjacent, unauthen
CVE-2026-44947 MEDIUM
6.9 Jun 30

Privilege persistence in SUSE Rancher allows project users to retain Pod Security Admission (PSA) permissions even after
CVE-2026-44948 MEDIUM
5.3 Jun 30

Path traversal in Rancher Fleet's ImageScan subsystem (CWE-23) allows authenticated remote attackers to escape intended

Same weakness CWE-294 – Authentication Bypass by Capture-replay

View all
CVE-2026-32053 MEDIUM POC
6.5
CVE-2025-68671 MEDIUM POC
6.5
CVE-2025-65552 CRITICAL
9.8
CVE-2025-67135 CRITICAL
9.8
CVE-2025-6030 CRITICAL
9.4
CVE-2025-6029 CRITICAL
9.4
CVE-2026-32987 CRITICAL
9.3
CVE-2025-13777 HIGH
7.2

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2014-1761 HIGH POC
7.8
CVE-2011-0609 HIGH POC
7.8
CVE-2013-3163 HIGH POC
8.8
CVE-2014-1776 CRITICAL POC
9.8

Share

EUVD-2026-40304 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy