CVE-2026-103314 in Advanced Cluster Security
Summary
by MITRE • 10/19/2026
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in Red Hat Advanced Cluster Security for Kubernetes involves a critical flaw within the Single Sign-On (SSO) implementation, specifically affecting the Assertion Consumer Service endpoint used for SAML-based authentication. This component is responsible for processing security assertions received from external Identity Providers to authenticate users and grant access to the Central management interface. The core technical deficiency lies in the application's failure to maintain a record of previously consumed SAML assertion or response identifiers. In standard secure implementations, these unique identifiers serve as nonces that prevent an attacker from reusing intercepted authentication tokens. By omitting this tracking mechanism, the system fails to enforce statefulness regarding active sessions and past authentications, creating a significant gap in the security controls designed to protect against replay attacks.
From an operational perspective, this flaw allows for straightforward exploitation by any actor who can intercept or otherwise obtain a valid, unexpired SAML response signed by a trusted Identity Provider. Because the Central endpoint does not verify whether a specific assertion identifier has already been processed, an attacker can submit the same captured token multiple times in rapid succession. Each submission is treated as a new authentication request and successfully validated against the signature without checking for prior usage. Consequently, this results in the generation of distinct Central authentication tokens for the mapped identity with each successful replay. This capability effectively bypasses session management controls that rely on unique identifiers to limit access frequency or detect anomalous behavior, allowing an attacker to maintain persistent or multiple concurrent sessions using a single captured credential artifact.
The security implications are severe, as this vulnerability directly undermines the integrity of the authentication process and facilitates unauthorized access through replay attacks. An adversary with network-level visibility or compromised credentials can exploit this flaw to gain repeated entry into the cluster management plane without needing to steal new tokens continuously. This behavior aligns closely with Common Weakness Enumeration category CWE-294, which describes Authentication Bypass by Capture-replay of Credentials. Furthermore, within the MITRE ATT&CK framework for Enterprise, this technique corresponds to T1588.002, specifically Credential Stuffing or Replay Attacks using Obtained Credentials such as SAML tokens. The ability to generate multiple valid sessions from a single intercepted response increases the attack surface significantly, potentially leading to privilege escalation if the mapped identity holds administrative privileges within the Kubernetes cluster environment.
To mitigate this risk, immediate action is required to ensure that all consumed SAML assertions and responses are tracked using their unique identifiers or timestamps. The application must implement a mechanism to store these identifiers in a persistent storage layer accessible across Central instances, particularly in high-availability deployments where state might otherwise be lost between nodes. When processing incoming authentication requests, the system should check this repository for duplicates before validating signatures or issuing new tokens. If an identifier is found to have been previously used within its valid time window, the request must be rejected immediately with a clear error indicating duplicate submission. Additionally, organizations should enforce strict network segmentation and monitor Central endpoints for unusual patterns of authentication requests originating from single source IPs or identities, which may indicate active exploitation attempts while patches are being applied.