CVE-2026-75034: CWE-294 Authentication bypass by capture-replay in SUSE Rancher
Description
A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a captured assertion could replay it once against every other replica to obtain additional authenticated sessions as the victim. This issue affects Rancher: before 2.15.1.
CVSS v3.1
Score 7.4high
Affected software
SUSE
Rancher
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Rancher Manager relates to insufficient SAML assertion replay protection. The fix for a previous vulnerability (CVE-2026-44946) implemented a per-process cache for consumed assertion IDs, but this design only prevents replay attacks within the same pod. In multi-replica high-availability setups, an attacker can replay a captured assertion once per replica, effectively bypassing authentication controls and obtaining additional authenticated sessions. This affects Rancher versions prior to 2.15.1.
Potential Impact
An attacker with a captured SAML assertion can bypass authentication by replaying the assertion against multiple Rancher Manager replicas in a high-availability deployment. This allows unauthorized access to multiple authenticated sessions as the victim, potentially leading to unauthorized access to sensitive management functions. The vulnerability does not impact availability but compromises confidentiality and integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor SUSE's advisories for updates. Until a fix is available, consider limiting exposure of Rancher Manager replicas and restricting access to trusted networks to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- suse
- Date Reserved
- 2026-08-17T15:22:54.444Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a9990d2acd9273b491c1d63
Added to database: 09/03/2026, 15:22:58 UTC
Last enriched: 09/07/2026, 12:32:27 UTC
Last updated: 10/16/2026, 18:48:24 UTC
Views: 59
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.