CVE-2026-44946

A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler did not enforce one-time use of SAML assertion, potentially allowing person in the middle attacks against Rancher, affecting Rancher 2.14.0 before 2.14.3,

Score

CVSS 4.0 9.5 Critical

Status

Analyzed - meissner@suse.de

Published

2026-06-30

Last modified

2026-07-01

Weaknesses

CWE-294

Affected products

• Rancher (Suse)

References

• https://github.com/rancher/rancher/security/advisories/GHSA-c5jm-xcmq-9j95