Red Hat RHACS: SAML response replay in Central authentication
Summary
Red Hat Advanced Cluster Security for Kubernetes (RHACS) Central does not record SAML assertion or response identifiers that have already been used. An attacker who obtains a valid, unexpired signed SAML response can submit it repeatedly and receive new Central authentication tokens for the mapped identity. Exploitation requires access to such a SAML response and network reachability of the Central SAML endpoint.
Affected
- Red Hat Advanced Cluster Security for Kubernetes 4.10 (affected before fixed build)
- Red Hat Advanced Cluster Security for Kubernetes 4.11 (affected before fixed build)
- Only deployments with a SAML authentication provider enabled are affected according to Red Hat.
- Status of other 4.x releases: Unknown.
Fixed in
- RHACS 4.11.6 (RHSA-2026:85932)
- RHACS 4.10.11 (RHSA-2026:92342)
- Exact fixed build identifiers: Unknown.
Workaround
- No vendor workaround available; apply the update.
- Until patched, restrict network access to the Central SAML ACS endpoint to trusted identity providers and networks.
- Reduce SAML assertion lifetimes at the identity provider where possible.
Exploitation
- No evidence of exploitation in the wild.
- No public proof of concept found.
- Not listed in CISA KEV.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Check whether RHACS Central uses SAML authentication and whether the ACS endpoint is reachable by untrusted parties.
- Update to RHACS 4.11.6 or 4.10.11 or later.
- Shorten SAML assertion lifetimes at the identity provider.
- Review Central logins for repeated sessions tied to a single identity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-103314 access.redhat.com
- Red Hat Errata RHSA-2026:85932 (RHACS 4.11.6) access.redhat.com
- Red Hat Errata RHSA-2026:92342 (RHACS 4.10.11) access.redhat.com
- Red Hat Bugzilla 2543879 bugzilla.redhat.com
- RHACS 4.11 release notes docs.redhat.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 00:55.
Original description (NVD)
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.