A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service

Rancher's Assertion Consumer Service (ACS) — the endpoint that receives SAML responses from your IdP — failed to enforce one-time use of SAML assertions. An attacker who captures both a valid signed SAML response *and* the victim's pre-authentication SAML state cookie can replay them against /v1-saml/.../callback and receive an independent, fully authenticated Rancher session inheriting the victim's roles. Affected versions: all Rancher 2.x lines prior to v2.14.3, v2.13.7, v2.12.11, v2.11.15 (fixes released 2026-06-29). Every SAML IdP integration is in scope — Okta, Ping, ADFS, Keycloak, Shibboleth.

There is no vendor CVSS assigned yet, so this is a first assessment. The bug is a classic CWE-294 authentication bypass by capture-replay, which usually earns a HIGH label when the payoff is a real session. The friction — needing both artifacts at once — is meaningful, but Rancher is canonically a fleet-management control plane for Kubernetes clusters, so a replayed admin session is not just "one user" — it can be the keys to every downstream cluster.

Why this verdict

• Role multiplier — Rancher IS a fleet control plane. ≥95% of Rancher installs sit in the canonical high-value role (managing 1..N downstream Kubernetes clusters). A replayed admin session ends in kubeconfig issuance for every reachable cluster → fleet compromise. Per the hard rule, floor is HIGH; CRITICAL only if unauthenticated + trivially exploitable, which this isn't.
• Friction — dual-artifact capture is real. Attacker must obtain BOTH a signed SAML Response AND the pre-auth state cookie within the assertion's validity window. This rules out passive network sniffing (TLS) and rules out most XSS (HttpOnly cookie). Realistic attack positions are compromised browser extensions, a malicious reverse proxy, or an insider with proxy log access — that is post-initial-access territory, which is why the score sits at HIGH not CRITICAL.
• Exposure — small internet footprint, large internal footprint. Only ~1,400 Rancher UIs are directly internet-exposed per Shodan, but most enterprise deployments are internal-only with SAML SSO. The bug is exploitable from any position that can see the auth exchange, so the population is defenders' *SAML-authenticated user base*, not the internet.
• No KEV, no PoC yet, but trivial to weaponize. The replay mechanic is a 20-line curl script once artifacts are captured. Expect a public PoC within the mitigation SLA window.

Why not higher?

Not CRITICAL because the attack is not unauthenticated-remote in the CVSS sense: it requires the attacker to be positioned to observe an active SAML login flow AND capture two distinct artifacts within a short window. There is no wormable pre-auth path from the open internet, and no evidence of in-the-wild exploitation. The chain ends in the *victim's* RBAC — global-admin capture is the worst case, not the guaranteed case.

Why not lower?

Not MEDIUM because the affected component is canonically a Kubernetes fleet control plane and the vuln is in the authentication boundary itself. Successful exploitation yields a real authenticated session, not just information disclosure, and downstream cluster admin is one API call away. Any authentication-boundary defect on a fleet-management plane clears the HIGH bar.

1. Upgrade Rancher to a fixed line — Deploy v2.14.3 / v2.13.7 / v2.12.11 / v2.11.15 within 30 days per noisgate mitigation SLA for HIGH. Rancher's Helm upgrade is a routine control-plane operation; rehearse in a non-prod cluster first, then rolling-upgrade production.
2. Restrict Rancher UI/API network exposure — Gate the Rancher UI behind a VPN, ZTNA, or IP allowlist so the attacker cannot POST to /v1-saml/*/callback even with captured artifacts. Deploy within days if you cannot upgrade immediately.
3. Shorten SAML assertion validity at the IdP — Configure Okta/Ping/ADFS/Keycloak to issue assertions with NotOnOrAfter of ≤2 minutes. This shrinks the replay window drastically and costs nothing. Apply within 7 days.
4. Alert on duplicate SAML assertion IDs in Rancher audit log — Pipe Rancher audit-log to your SIEM and alert on two login-success events with the same assertionID or two logins for the same NameID within 60 seconds. This detects live exploitation while you upgrade.
5. Force re-auth for all active sessions post-upgrade — After patching, invalidate existing R_SESS tokens (kubectl -n cattle-system delete tokens --all on the local cluster) to burn any pre-existing replayed sessions.

Run on any host with curl and jq that can reach your Rancher server, from an auditor workstation. Invoke as ./check-cve-2026-44946.sh https://rancher.example.com — no privileges required, it reads the /rancherversion unauthenticated endpoint.

#!/usr/bin/env bash
# noisgate check for CVE-2026-44946 (Rancher SAML ACS replay)
# Usage: ./check-cve-2026-44946.sh https://rancher.example.com
set -u

RANCHER_URL="${1:-}"
if [[ -z "$RANCHER_URL" ]]; then
  echo "Usage: $0 https://rancher.example.com" >&2
  exit 2
fi

VER_JSON=$(curl -fsSk "${RANCHER_URL%/}/rancherversion" 2>/dev/null)
if [[ -z "$VER_JSON" ]]; then
  echo "UNKNOWN: could not reach ${RANCHER_URL}/rancherversion"
  exit 3
fi

VERSION=$(echo "$VER_JSON" | grep -oE '"Version"[[:space:]]*:[[:space:]]*"[^"]+"' | sed -E 's/.*"([^"]+)"$/\1/' | sed 's/^v//')
if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN: could not parse version from response"
  exit 3
fi

# Compare against fixed lines: 2.11.15 / 2.12.11 / 2.13.7 / 2.14.3
MAJOR=$(echo "$VERSION" | awk -F. '{print $1}')
MINOR=$(echo "$VERSION" | awk -F. '{print $2}')
PATCH=$(echo "$VERSION" | awk -F. '{print $3}' | grep -oE '^[0-9]+')

if [[ "$MAJOR" != "2" ]]; then
  echo "UNKNOWN: unexpected major version ${VERSION}"
  exit 3
fi

declare -A FIXED=( [11]=15 [12]=11 [13]=7 [14]=3 )
FIX=${FIXED[$MINOR]:-}
if [[ -z "$FIX" ]]; then
  echo "UNKNOWN: unsupported minor line 2.${MINOR}.x (version ${VERSION})"
  exit 3
fi

if (( PATCH >= FIX )); then
  echo "PATCHED: Rancher ${VERSION} >= fix 2.${MINOR}.${FIX}"
  exit 0
else
  echo "VULNERABLE: Rancher ${VERSION} < fix 2.${MINOR}.${FIX} — CVE-2026-44946"
  exit 1
fi

Sources

1. Rancher Security Advisories
2. Rancher GitHub Security Advisories
3. CWE-294: Authentication Bypass by Capture-Replay
4. Rancher SAML auth provider docs
5. SAMLRaider (Burp extension for SAML replay testing)
6. OASIS SAML 2.0 Core — assertion replay protection guidance (§4.1.4.5)
7. CISA KEV Catalog (check for future listing)
8. FIRST EPSS lookup