CVE-2026-44946 Details

A SAML authentication replay vulnerability has been identified in Rancher's Assertion Consumer Service (ACS) handler, affecting versions 2.14.0 prior to 2.14.3, 2.13.0 prior to 2.13.7, 2.12.0 prior to 2.12.11, and 2.11.0 prior to 2.11.15. The vulnerability arises because Rancher's SAML login process does not enforce the one-time use of SAML assertions, allowing the same signed SAML response to be reused for multiple authenticated sessions. This issue impacts all SAML-based authentication providers supported by Rancher, including Okta, Ping, ADFS, Keycloak, and Shibboleth, as they all utilize the same ACS handler.

Users can upgrade to Rancher versions 2.14.3, 2.13.7, 2.12.11, or 2.11.15, all of which include the necessary fix. For those unable to upgrade, a partial mitigation involves reducing the SAML assertion validity window at the Identity Provider level, which limits the time frame for replaying a captured assertion. Additionally, restricting network access to the Rancher SAML ACS endpoint and enforcing TLS inspection can reduce the likelihood of intercepting SAML traffic, though it does not completely eliminate the vulnerability.