Which versions of Rancher are affected by EUVD-2026-40304?

Rancher's Kubernetes management platform (versions 2.14.0-2.14.2) contains a critical authentication bypass allowing unauthenticated attackers to replay captured SAML credentials and assume…. A patch is available.

How to fix or mitigate EUVD-2026-40304?

Within 24 hours: identify all Rancher deployments running versions 2.14.0, 2.14.1, or 2.14.2 with SAML authentication enabled. Within 7 days: implement network segmentation to prevent SAML traffic interception, enable comprehensive authentication logging, and evaluate temporary SAML disablement. Within 30 days: monitor Rancher security advisories for patch release and prepare upgrade to patched version once available.

Rancher EUVD-2026-40304

Q: What is the CVSS score of EUVD-2026-40304?

EUVD-2026-40304 has a CVSS 4.0 base score of 9.5 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-44946 CRITICAL

Authentication Bypass by Capture-replay (CWE-294)

2026-06-30 suse

Denial Of Service Rancher Suse

9.5

CVSS 4.0 · Vendor: suse

Severity by source

Vendor (suse) PRIMARY

9.5 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.7 HIGH

Network-reachable but requires a MITM position to capture a live assertion (AC:H); no credentials to replay (PR:N); Rancher compromise cascades to managed clusters (S:C, C:H/I:H), with no direct availability impact (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 30, 2026 - 14:01 EUVD

Analysis Generated

Jun 30, 2026 - 12:52 vuln.today

DescriptionCVE.org

A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler did not enforce one-time use of SAML assertion, potentially allowing person in the middle attacks against Rancher, affecting Rancher 2.14.0 before 2.14.3,

AnalysisAI

SAML assertion replay in Rancher's Assertion Consumer Service (ACS) handler lets a person-in-the-middle who captures a victim's SAML response reuse that assertion to authenticate as the victim, because the handler never enforces one-time use. Rancher 2.14.0 through 2.14.2 are affected, and because Rancher governs downstream Kubernetes clusters, a successful replay can yield administrative control. No public exploit identified at time of analysis; the issue is not on the CISA KEV list, and the carried CVSS 4.0 base score is 9.5 driven largely by the scope/subsequent-system impact.

Technical ContextAI

Rancher is a SUSE-maintained multi-cluster Kubernetes management platform that supports SAML-based single sign-on (e.g. Okta, ADFS, Keycloak, Shibboleth) for operator login. During SP-initiated SSO, the identity provider posts a signed SAML assertion to Rancher's ACS endpoint; the SP is responsible for enforcing single-use semantics by tracking assertion IDs and the NotOnOrAfter / one-time-use conditions. This flaw is CWE-294 (Authentication Bypass by Capture-replay): the ACS handler validated the assertion but did not record or reject previously consumed assertions, so the same signed assertion remained valid more than once. The affected component is identified by CPE cpe:2.3:a:suse:rancher and is limited to the 2.14.x line below 2.14.3.

RemediationAI

Vendor-released patch: upgrade to Rancher 2.14.3, which the version range ('2.14.0 before 2.14.3') confirms as the fixed release; follow the upgrade guidance in advisory https://github.com/rancher/rancher/security/advisories/GHSA-c5jm-xcmq-9j95. Where immediate upgrade is not possible, reduce exposure by ensuring all SAML traffic is carried over strictly enforced TLS end-to-end (so assertions cannot be captured in transit), shortening the IdP assertion validity window and enabling OneTimeUse / tight NotOnOrAfter conditions at the identity provider, and restricting network paths between users, the IdP, and the Rancher ACS endpoint to trusted segments - each of these narrows the replay window but does not fully close the server-side single-use gap, so they are stopgaps until 2.14.3 is applied. As an alternative interim control, switching authentication away from SAML to a non-affected provider avoids the vulnerable code path at the cost of SSO functionality.