CVE-2026-75034— Rancher: SAML Assertion Replay
Quick assessment
Affected
SUSE Rancher
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Rancher Manager 中发现一个缺陷。此前为修复 CVE-2026-44946 而引入的 SAML 断言重放保护机制，将已使用的断言 ID 记录在每进程（per-process）缓存中，因此每个副本（replica）只能检测到达同一个 Pod 的重放请求。在高可用（HA）部署环境下，持有已捕获断言的攻击者可以将该断言重放一次到每个其他副本，从而为受害者获得额外的已认证会话。 此问题影响 Rancher 2.15.1 之前的版本。
Possible ATT&CK Techniques 1 AI
T1531 · Account Access Removal
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-75034
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rancher: SAML Assertion Replay
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a captured assertion could replay it once against every other replica to obtain additional authenticated sessions as the victim.
This issue affects Rancher: before 2.15.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用捕获-重放进行的认证绕过
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-75034
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-75034
请登录查看更多情报信息。
Vendor Pages for CVE-2026-75034 (1)
Same Patch Batch · SUSE · 2026-09-03 · 6 CVEs total
| CVE-2026-71404 | 8.7 HIGH | Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation o |
| CVE-2026-75033 | 7.7 HIGH | Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing |
| CVE-2026-75035 | 7.7 HIGH | Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scop |
| CVE-2026-71403 | 6.1 MEDIUM | Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind |
| CVE-2026-75036 | 5.3 MEDIUM | Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing |
IV. Related Vulnerabilities
Same product: Rancher
-
CVE-2026-75035
Rancher: ext.cattle.io/v1 Token store: cross-user token disc -
CVE-2026-75033
Rancher: Cross-Cluster Secret Leakage via Namespace projectI -
CVE-2026-71404
Rancher: Ownership-less ClusterRole overwrite via attacker-c -
CVE-2026-71403
Rancher: Identity-field mutation in /v3/users allows account -
CVE-2026-44945
Cross-Cluster Impersonation Confused-Deputy Privilege Escala
Same vendor: SUSE
-
CVE-2026-75036
Fleet: DNS exfiltration via Sprig getHostByName in fleet.yam -
CVE-2026-75035
Rancher: ext.cattle.io/v1 Token store: cross-user token disc -
CVE-2026-75033
Rancher: Cross-Cluster Secret Leakage via Namespace projectI -
CVE-2026-71404
Rancher: Ownership-less ClusterRole overwrite via attacker-c -
CVE-2026-71403
Rancher: Identity-field mutation in /v3/users allows account
Same weakness: CWE-294
-
CVE-2026-53636
Open edX LTI OAuth Replay Attack -
CVE-2026-12704
SAML assertion replay via skipped InResponseTo validation -
CVE-2026-84306
Filament: Multi-factor authentication (app) codes can still -
CVE-2026-82470
Rodauth before 2.47.0 TOTP Code Reuse via Drift Window -
CVE-2026-13734
Zephyr WireGuard mutates peer state before anti-replay check
V. Comments for CVE-2026-75034
No comments yet