Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103314— Stackrox: stackrox: saml response replay allows multiple central authentication tokens

Quick assessment

Affected
Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.11
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Red Hat Advanced Cluster Security for Kubernetes（RHACS）中发现了一个安全漏洞。中央 SAML 认证 ACS 端点未保留已使用的 SAML 断言或响应标识符，从而无法防止重放攻击。攻击者若获取到有效的、未过期的已签名 SAML 响应，便可多次提交该响应，并针对同一映射身份获得多个不同的中央认证令牌。

CVSS 7.4 · High EPSS 0.26% · P17

Possible ATT&CK Techniques 1 AI

T1528.002

Affected Version Matrix 2

VendorProduct Version RangeStatus
Red Hat Red Hat Advanced Cluster Security 4 any affected
any affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103314

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Stackrox: stackrox: saml response replay allows multiple central authentication tokens
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用捕获-重放进行的认证绕过
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.11 1792492060 ~ * cpe:/a:redhat:advanced_cluster_security:4.11::el9
Red Hat Red Hat Advanced Cluster Security 4 - cpe:/a:redhat:advanced_cluster_security:4

II. Public POCs for CVE-2026-103314

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103314

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-103314 (2)

Other References for CVE-2026-103314 (1)

Same Patch Batch · Red Hat · 2026-10-19 · 10 CVEs total

CVE-2026-16487 8.1 HIGH Bootc: containers-common: bootc: automatic updates can apply unsigned mutable-tag content
CVE-2026-112261 7.8 HIGH Gimp: gimp: use-after-free in xcf loader via prop_selected_path
CVE-2026-112258 7.8 HIGH Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels
CVE-2026-112257 7.8 HIGH Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)
CVE-2026-16460 7.4 HIGH Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signatur
CVE-2026-112260 7.1 HIGH Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing
CVE-2026-112214 6.5 MEDIUM Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in
CVE-2026-112210 6.0 MEDIUM Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service
CVE-2026-112259 5.5 MEDIUM Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import

IV. Related Vulnerabilities

Same vendor: Red Hat
Same weakness: CWE-294

V. Comments for CVE-2026-103314

No comments yet

Leave a comment