{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103314", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-09-30T11:57:54.198Z", "datePublished": "2026-10-19T12:14:27.338Z", "dateUpdated": "2026-10-20T21:30:42.326Z"}, "containers": {"cna": {"title": "Stackrox: stackrox: saml response replay allows multiple central authentication tokens", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Security for Kubernetes 4.11", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "advanced-cluster-security/rhacs-main-rhel9", "defaultStatus": "affected", "versions": [{"version": "1792492060", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:advanced_cluster_security:4.11::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Advanced Cluster Security 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "advanced-cluster-security/rhacs-main-rhel8", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:advanced_cluster_security:4"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:85932", "name": "RHSA-2026:85932", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-103314", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543879", "name": "RHBZ#2543879", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-10-19T10:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-294", "description": "Authentication Bypass by Capture-replay", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-294: Authentication Bypass by Capture-replay", "workarounds": [{"lang": "en", "value": "Until an update is available, restrict network access to the Central SAML ACS endpoint to trusted identity providers and networks, and reduce SAML assertion lifetimes at the identity provider where possible.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce replay tracking on the Central SAML Assertion Consumer Service endpoint to record and reject previously consumed assertion and response identifiers: upgrade to RHACS 4.11.6 (or the fixed Advanced Cluster Security/Rhacs Main Rhel builds), which record and reject previously consumed SAML response and assertion identifiers at the ACS endpoint, closing all 2 injection vectors (SAML response replay, SAML assertion identifier reuse). Until patched, this is only a concern on RHACS Central deployments on Linux with SAML authentication enabled and a reachable ACS endpoint \u2014 Deployments that do not use SAML authentication or rely on OIDC ID-token logins are unaffected \u2014 so Restrict network access to the Central SAML ACS endpoint to trusted identity providers and networks, and reduce SAML assertion lifetimes at the identity provider. As a compensating measure, Configure host-based firewall rules using firewalld or nftables to restrict reachability to the Central SAML ACS endpoint to authorized identity providers and trusted client subnets and Apply network segmentation via VLANs or subnets to isolate the network path to RHACS Central and restrict reachability to the SAML ACS endpoint. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing SAML replay protection defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-202 Host-Based Firewall (firewalld/nftables) (medium)"}], "timeline": [{"lang": "en", "time": "2026-09-28T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-19T10:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Austin Chu (U.C. Berkeley), Corban Villa (U.C. Berkeley), and Sohee Kim (U.C. Berkeley) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-20T21:30:42.326Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-19T15:06:14.722673Z", "id": "CVE-2026-103314", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T15:06:23.293Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-103314", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-19T15:06:14.722673Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T15:06:19.037Z"}}], "cna": {"title": "Stackrox: stackrox: saml response replay allows multiple central authentication tokens", "credits": [{"lang": "en", "value": "Red Hat would like to thank Austin Chu (U.C. Berkeley), Corban Villa (U.C. Berkeley), and Sohee Kim (U.C. Berkeley) for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:advanced_cluster_security:4.11::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Security for Kubernetes 4.11", "versions": [{"status": "unaffected", "version": "1792492060", "lessThan": "*", "versionType": "rpm"}], "packageName": "advanced-cluster-security/rhacs-main-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:advanced_cluster_security:4"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Security 4", "packageName": "advanced-cluster-security/rhacs-main-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-09-28T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-19T10:00:00.000Z", "value": "Made public."}], "datePublic": "2026-10-19T10:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:85932", "name": "RHSA-2026:85932", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-103314", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543879", "name": "RHBZ#2543879", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Until an update is available, restrict network access to the Central SAML ACS endpoint to trusted identity providers and networks, and reduce SAML assertion lifetimes at the identity provider where possible.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce replay tracking on the Central SAML Assertion Consumer Service endpoint to record and reject previously consumed assertion and response identifiers: upgrade to RHACS 4.11.6 (or the fixed Advanced Cluster Security/Rhacs Main Rhel builds), which record and reject previously consumed SAML response and assertion identifiers at the ACS endpoint, closing all 2 injection vectors (SAML response replay, SAML assertion identifier reuse). Until patched, this is only a concern on RHACS Central deployments on Linux with SAML authentication enabled and a reachable ACS endpoint \u2014 Deployments that do not use SAML authentication or rely on OIDC ID-token logins are unaffected \u2014 so Restrict network access to the Central SAML ACS endpoint to trusted identity providers and networks, and reduce SAML assertion lifetimes at the identity provider. As a compensating measure, Configure host-based firewall rules using firewalld or nftables to restrict reachability to the Central SAML ACS endpoint to authorized identity providers and trusted client subnets and Apply network segmentation via VLANs or subnets to isolate the network path to RHACS Central and restrict reachability to the SAML ACS endpoint. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing SAML replay protection defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-202 Host-Based Firewall (firewalld/nftables) (medium)"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-294", "description": "Authentication Bypass by Capture-replay"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-20T21:30:42.326Z"}, "x_redhatCweChain": "CWE-294: Authentication Bypass by Capture-replay"}}, "cveMetadata": {"cveId": "CVE-2026-103314", "state": "PUBLISHED", "dateUpdated": "2026-10-20T21:30:42.326Z", "dateReserved": "2026-09-30T11:57:54.198Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-10-19T12:14:27.338Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:advanced_cluster_security:4.11::el9"], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-main-rhel9", "product": "Red Hat Advanced Cluster Security for Kubernetes 4.11", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1792492060", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:advanced_cluster_security:4"], "defaultStatus": "affected", "packageName": "advanced-cluster-security/rhacs-main-rhel8", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity."}], "id": "CVE-2026-103314", "lastModified": "2026-10-20T13:16:38.277", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103314", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-19T15:06:14.722673Z", "version": "2.0.3"}}]}, "published": "2026-10-19T13:16:53.617", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:85932"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-103314"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543879"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-294"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Austin Chu (U.C. Berkeley), Corban Villa (U.C. Berkeley), and Sohee Kim (U.C. Berkeley) for reporting this issue.", "bugzilla": {"description": "stackrox: stackrox: SAML response replay allows multiple Central authentication tokens", "id": "2543879", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543879"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-294", "details": ["A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity."], "mitigation": {"lang": "en:us", "value": "Until an update is available, restrict network access to the Central SAML ACS endpoint to trusted identity providers and networks, and reduce SAML assertion lifetimes at the identity provider where possible."}, "name": "CVE-2026-103314", "package_state": [{"cpe": "cpe:/a:redhat:advanced_cluster_security:4", "fix_state": "Affected", "package_name": "advanced-cluster-security/rhacs-main-rhel8", "product_name": "Red Hat Advanced Cluster Security 4"}, {"cpe": "cpe:/a:redhat:advanced_cluster_security:4", "fix_state": "Affected", "package_name": "advanced-cluster-security/rhacs-main-rhel9", "product_name": "Red Hat Advanced Cluster Security 4"}], "public_date": "2026-10-19T10:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-103314\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-103314"], "statement": "This issue only affects RHACS deployments that have a SAML authentication provider enabled and whose ACS endpoint is reachable by the attacker. An attacker must first obtain a valid signed SAML response before it expires. Deployments that do not use SAML authentication are not affected. The OIDC ID-token login path already includes replay protection.", "threat_severity": "Important"}