CVE Alert: CVE-2026-103314 – Red Hat

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.

**Risk verdict:** Prioritise remediation promptly: this enables serious identity abuse, although the supplied data does not establish whether exploitation is active or publicly demonstrated.

**Why this matters:** A stolen, still-valid SAML response could let an attacker act as its mapped user and obtain repeated sessions. The resulting exposure depends on that user’s Central permissions, but could include sensitive cluster information or unauthorised security-policy changes. KEV, SSVC, PoC and EPSS indicators were not supplied, so exploitation likelihood cannot be confidently ranked.

**Most likely attack path:** The attacker needs network reachability to the SAML ACS endpoint and access to a valid signed response; elevated privileges and user interaction are not otherwise required. High attack complexity makes obtaining that response the key hurdle. Impact is bounded to the affected security authority, though an account with broad cluster-management rights could enable consequential actions across managed environments.

**Who is most exposed:** Organisations using SAML single sign-on for Central, particularly where the ACS endpoint is broadly reachable or assertions remain valid for longer periods.

Alert on repeated ACS submissions with the same assertion or response identifier.

Correlate authentication events for one SAML identity across multiple token issuances.

Review unusual Central sessions, source networks and privileged actions after SAML logins.

Mitigation and prioritisation:

Apply the vendor’s security update promptly once available; confirm the fix in a test environment before broad rollout.

Until patched, restrict ACS access to trusted identity-provider and network paths.

Reduce assertion lifetimes and review identity-provider logs for suspicious reuse.

Revoke suspicious sessions and assess activity performed by affected identities.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.