CVE-2026-103314
7.4HighPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-294
Impact
Attackers can generate unauthorized Central authentication tokens by replaying captured SAML assertions to authenticate as the mapped user. To exploit this, an attacker must first intercept or obtain a valid, unexpired signed SAML response.
Root cause
The Central SAML endpoint does not track or store previously seen assertion IDs, allowing valid SAML responses to be replayed within their validity window.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade Red Hat Advanced Cluster Security (RHACS) Central once fixed packages are available. As an interim workaround, reduce the SAML assertion validity lifetime on your identity provider to shrink the replay window, or temporarily switch to OIDC.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.