{"id":"CVE-2026-103314","kind":"vulnerability","aliases":["CVE-2026-103314"],"related":[],"title":"Red Hat ACS: SAML replay lets captured login responses mint new sessions","description":"A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.","summary":"Red Hat Advanced Cluster Security for Kubernetes (RHACS) Central does not record SAML assertion or response IDs, so a valid signed SAML response can be submitted repeatedly. Each submission yields a fresh Central authentication token for the mapped user.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kubernetes","red-hat","rhacs","saml"],"not_affected_if":["no-saml-login","non-rhacs"],"how_to_check":"- Check whether Central uses SAML login: look for a SAML identity provider configured under Platform Configuration > Access Control in the RHACS console.\n- Check the RHACS version running on Central: `roxctl version` or the version shown in the Central UI; compare against the fixed release in Red Hat's advisory (unknown from the sources).","fix":"- Upgrade RHACS Central to a fixed release; the fixed version is unknown from the sources, so check the Red Hat advisory for CVE-2026-103314.\n- Until patched, restrict who can reach the Central SAML ACS endpoint and review SAML identity provider settings.","status":"open","published_at":"2026-10-19T13:16:53+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:27:13+00:00","updated_at":"2026-10-25T03:27:13+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:27:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade RHACS Central to a fixed release; the fixed version is unknown from the sources, so check the Red Hat advisory for CVE-2026-103314.\n- Until patched, restrict who can reach the Central SAML ACS endpoint and review SAML identity provider settings.","reach":"network","title":"Red Hat ACS: SAML replay lets captured login responses mint new sessions","impact":"high","summary":"Red Hat Advanced Cluster Security for Kubernetes (RHACS) Central does not record SAML assertion or response IDs, so a valid signed SAML response can be submitted repeatedly. Each submission yields a fresh Central authentication token for the mapped user.","category":"infrastructure","nicknames":[],"who_cares":["kubernetes","rhacs","saml","red-hat"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker replays captured SAML response to obtain Central tokens","analyst_note":"Find the Red Hat advisory and fixed RHACS versions for CVE-2026-103314, and confirm whether the SAML endpoint is reachable without prior access.","how_to_check":"- Check whether Central uses SAML login: look for a SAML identity provider configured under Platform Configuration > Access Control in the RHACS console.\n- Check the RHACS version running on Central: `roxctl version` or the version shown in the Central UI; compare against the fixed release in Red Hat's advisory (unknown from the sources).","needs_analyst":true,"not_affected_if":["no-saml-login","non-rhacs"],"who_is_affected":"Only deployments of RHACS Central that authenticate users through SAML are described as affected. Installations using other login methods, such as local users or OIDC, are not covered by this description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000656,"input_tokens":3341,"output_tokens":643,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-103314':15A,18A '-2026':14A,17A 'ac':3A,82C 'advanc':28B,72C 'assert':39B,89C 'attack':97C 'authent':59B,81C,115C 'captur':7A 'central':34B,58B,79C,114C 'cluster':29B,73C 'cve':13A,16A 'distinct':113C 'endpoint':83C 'flaw':66C 'found':68C 'fresh':57B 'hat':2A,23B,27B,71C 'id':42B 'ident':120C 'identifi':92C 'infrastructur':19B 'kubernet':20B,32B,76C 'let':6A 'login':8A 'map':63B,119C 'mint':10A 'multipl':109C 'new':11A 'obtain':99C 'prevent':94C 'receiv':112C 'record':37B 'red':1A,22B,26B,70C 'red-hat':21B 'repeat':52B 'replay':5A,95C 'respons':9A,41B,48B,91C,105C 'retain':86C 'rhac':24B,33B,77C 'saml':4A,25B,38B,47B,80C,88C,104C 'secur':30B,74C 'session':12A 'sign':46B,103C 'submiss':54B 'submit':51B,107C 'time':110C 'token':60B,116C 'unexpir':102C 'use':87C 'user':64B 'valid':45B,101C 'yield':55B","nicknames":[],"mitigations":[],"who_affected":"Only deployments of RHACS Central that authenticate users through SAML are described as affected. Installations using other login methods, such as local users or OIDC, are not covered by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T13:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103314","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103314","severity":null,"published_at":"2026-10-19T13:16:53+00:00","modified_at":"2026-10-20T13:16:38+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}