Stackrox: stackrox: saml response replay allows multiple central authentication tokens
Summary
| CVE | CVE-2026-103314 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-19 13:16:53 UTC |
| Updated | 2026-10-31 10:16:30 UTC |
| Description | A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity. |
Risk And Classification
Primary CVSS: v3.1 7.4 HIGH from [email protected]
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.004050000 probability, percentile 0.347780000 (date 2026-11-02)
Problem Types: CWE-294 | CWE-294 Authentication Bypass by Capture-replay
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 7.4 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 3.1 | CNA | CVSS | 7.4 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Advanced Cluster Security For Kubernetes 4.10 | unaffected 1793184257 * rpm | Not specified |
| CNA | Red Hat | Red Hat Advanced Cluster Security For Kubernetes 4.11 | unaffected 1792492060 * rpm | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-103314 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:92342 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:85932 | [email protected] | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Red Hat would like to thank Austin Chu (U.C. Berkeley), Corban Villa (U.C. Berkeley), and Sohee Kim (U.C. Berkeley) for reporting this issue. (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-09-28T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2026-10-19T10:00:00.000Z | Made public. |
Workarounds
CNA: Until an update is available, restrict network access to the Central SAML ACS endpoint to trusted identity providers and networks, and reduce SAML assertion lifetimes at the identity provider where possible. --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce replay tracking on the Central SAML Assertion Consumer Service endpoint to record and reject previously consumed assertion and response identifiers: upgrade to RHACS 4.11.6 (or the fixed Advanced Cluster Security/Rhacs Main Rhel builds), which record and reject previously consumed SAML response and assertion identifiers at the ACS endpoint, closing all 2 injection vectors (SAML response replay, SAML assertion identifier reuse). Until patched, this is only a concern on RHACS Central deployments on Linux with SAML authentication enabled and a reachable ACS endpoint — Deployments that do not use SAML authentication or rely on OIDC ID-token logins are unaffected — so Restrict network access to the Central SAML ACS endpoint to trusted identity providers and networks, and reduce SAML assertion lifetimes at the identity provider. As a compensating measure, Configure host-based firewall rules using firewalld or nftables to restrict reachability to the Central SAML ACS endpoint to authorized identity providers and trusted client subnets and Apply network segmentation via VLANs or subnets to isolate the network path to RHACS Central and restrict reachability to the SAML ACS endpoint. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing SAML replay protection defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-202 Host-Based Firewall (firewalld/nftables) (medium)