CVE-2026-75034: Rancher: SAML Assertion Replay
A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a captured assertion could replay it once against every other replica to obtain additional authenticated sessions as the victim.
This issue affects Rancher: before 2.15.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rancher Managerto a version that resolves this vulnerability.Fixed in 2.15.1Patch CVE-2026-44946
Event History
Frequently Asked Questions
Which deployments are exposed to assertion replay across replicas?
High-availability Rancher Manager deployments with multiple replicas are exposed, because consumed SAML assertion IDs were tracked only in each process's local cache. A replay sent to a different pod would not be recognized as already consumed.
What does an attacker need to exploit this issue?
The attacker needs a captured SAML assertion. They can replay that assertion against other Rancher Manager replicas to obtain additional authenticated sessions as the assertion's victim.
Are single-replica deployments affected in the same way?
The described cross-replica replay condition depends on multiple replicas using separate per-process caches. A single replica detects replays that reach that same pod.
Which versions should be remediated?
Rancher versions before 2.15.1 are affected. Upgrade to 2.15.1 or later.