CVE-2026-75034 in Rancher
Summary
by MITRE • 09/03/2026
A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a captured assertion could replay it once against every other replica to obtain additional authenticated sessions as the victim.
This issue affects Rancher: before 2.15.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in Rancher Manager represents a critical failure in session management and authentication integrity, specifically within the SAML-based Single Sign-On implementation. This flaw stems from an incomplete remediation of a previous security issue, CVE-2026-44946, which attempted to implement protection against assertion replay attacks but did so with a fundamental architectural oversight. The original fix relied on recording consumed assertion identifiers in a cache that was scoped strictly to the individual application process or pod instance handling the request. In modern cloud-native and containerized environments, services are typically deployed using high-availability configurations involving multiple replicas behind a load balancer. Because each replica maintains its own isolated memory space for tracking used assertions, there is no shared state mechanism to propagate information about consumed IDs across the cluster. This design flaw creates a significant gap in security enforcement that allows attackers to bypass authentication controls by exploiting the distributed nature of the deployment architecture.
From an operational perspective, this vulnerability enables a sophisticated replay attack where an adversary can capture a valid SAML assertion intended for one user and reuse it against other active replicas within the Rancher cluster. Since each replica operates independently regarding its cache of consumed assertions, the first request using the captured ID may be processed by one pod, but subsequent requests sent to different pods will not recognize that the ID has already been used. Consequently, an attacker can iterate through available service instances, successfully authenticating as the victim on multiple sessions simultaneously. This capability effectively nullifies the intended protection against replay attacks and allows for unauthorized access to the Rancher management interface under the guise of a legitimate user session. The impact is severe, potentially leading to full compromise of cluster resources, manipulation of workloads, or lateral movement within the underlying Kubernetes infrastructure if administrative privileges are associated with the victim account.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) categories such as CWE-294: Authentication Bypass by Capture-replay and CWE-613: Insufficient Session Expiration. The root cause is a classic state management error where critical security context data, specifically the list of valid or consumed tokens, fails to be shared across distributed nodes in a manner required for consistent enforcement. In terms of the MITRE ATT&CK framework, this behavior corresponds to techniques involving credential replay and session hijacking, allowing an attacker to maintain persistent access without needing to steal passwords or exploit additional software flaws beyond the configuration logic itself. The failure lies not necessarily in the cryptographic strength of the SAML assertions but in the application-layer logic that governs their lifecycle and validation scope within a clustered environment.
To mitigate this risk, organizations running Rancher Manager versions prior to 2.15.1 must upgrade immediately to version 2.15.1 or later, where the assertion replay protection has been corrected to utilize a shared state mechanism such as Redis or another distributed cache that is accessible by all replicas in the cluster. This ensures that once an assertion ID is consumed by any node, it is marked as invalid across the entire service mesh, preventing subsequent reuse attempts from succeeding regardless of which pod processes the request. Until the upgrade can be performed, administrators should consider implementing network-level controls such as strict rate limiting on authentication endpoints to reduce the window of opportunity for replay attacks. Additionally, enabling comprehensive audit logging and monitoring for multiple concurrent sessions originating from a single user account or IP address can help detect potential exploitation attempts in real-time. It is also advisable to review SAML provider configurations to ensure that assertion lifetime windows are as short as possible, thereby limiting the temporal validity period during which a captured token could be exploited across different replicas.