7.4Hoch
CVE-2026-103314Stackrox: stackrox: saml response replay allows multiple central authentication tokens
Beschreibung
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.
Schwachstellentyp (CWE):
CWE-294
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| advanced cluster security | 4.10 | — | |
| advanced cluster security | 4.11 | — | |
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.10 | all versions | |
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.11 | all versions |
Referenzen und Patches
- RHSA-2026:85932 vendor-advisory
- RHSA-2026:92342 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-103314 vdb-entry
- RHBZ#2543879 issue-tracking