---
id: "CVE-2026-103314"
kind: "vulnerability"
aliases: ["CVE-2026-103314"]
title: "Red Hat ACS: SAML replay lets captured login responses mint new sessions"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "kubernetes", "red-hat", "rhacs", "saml"]
not_affected_if: ["no-saml-login", "non-rhacs"]
published_at: "2026-10-19T13:16:53+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T03:27:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103314", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Red Hat ACS: SAML replay lets captured login responses mint new sessions

Red Hat Advanced Cluster Security for Kubernetes (RHACS) Central does not record SAML assertion or response IDs, so a valid signed SAML response can be submitted repeatedly. Each submission yields a fresh Central authentication token for the mapped user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether Central uses SAML login: look for a SAML identity provider configured under Platform Configuration > Access Control in the RHACS console.
- Check the RHACS version running on Central: `roxctl version` or the version shown in the Central UI; compare against the fixed release in Red Hat's advisory (unknown from the sources).

## Fix

- Upgrade RHACS Central to a fixed release; the fixed version is unknown from the sources, so check the Red Hat advisory for CVE-2026-103314.
- Until patched, restrict who can reach the Central SAML ACS endpoint and review SAML identity provider settings.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103314

## From the sources

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_