Skip to content
CVE-2026-103314: Red Hat Security Flaw Allows SAML Token Replay

CVE-2026-103314: Red Hat Security Flaw Allows SAML Token Replay

First seen 19 Oct 2026, 15:19 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 19, 2026 at 16:21 UTC
  • •CVE-2026-103314 allows replay of SAML tokens in RHACS.
  • •Attackers can gain multiple authentication tokens if they obtain a valid SAML response.
  • •Organizations using SAML authentication for Central are most at risk.

A vulnerability (CVE-2026-103314) was discovered in Red Hat Advanced Cluster Security for Kubernetes (RHACS), affecting deployments with SAML authentication enabled. The flaw allows attackers to reuse valid, unexpired signed SAML responses to obtain multiple Central authentication tokens for the same user identity. This issue primarily impacts organizations where the ACS endpoint is accessible and SAML assertions remain valid for extended periods. The risk includes potential unauthorized access to sensitive cluster information and security policy alterations, depending on the permissions of the compromised user account. Red Hat advises restricting access to the ACS endpoint and reducing SAML assertion lifetimes until a patch is available. The vulnerability has a CVSS score of 7.4, indicating high severity. No or proof-of-concept code has been reported at this time.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-19
CVE-2026-103314 published
Red Hat disclosed a vulnerability in RHACS affecting SAML authentication, allowing token replay.
Redpacketsecurity
2026-10-19
Advisory issued
Red Hat recommended restricting access to the ACS endpoint and reducing assertion lifetimes until a patch is available.
access.redhat.com

More articles in this cluster (2)

Following this threat?

Track Red Hat and CVE-2026-103314 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 3

Common questions

Who is affected by CVE-2026-103314?
Organizations using Red Hat Advanced Cluster Security with SAML authentication enabled are affected.
What should I do until a patch is released?
Restrict access to the Central SAML ACS endpoint and reduce the lifetime of SAML assertions.
Is there any active exploitation of this vulnerability?
No active exploitation has been reported at this time.