CVE-2026-103314: Stackrox: stackrox: saml response replay allows multiple central authentication tokens

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-19 · updated 2026-10-31
Weakness: CWE-294

Description

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.

Affected products

Red Hat Advanced Cluster Security for Kubernetes 4.10: all versions — fixed in 1793184257
Red Hat Advanced Cluster Security for Kubernetes 4.11: all versions — fixed in 1792492060

How to fix

Upgrade to a fixed version: Red Hat Advanced Cluster Security for Kubernetes 4.10 1793184257; Red Hat Advanced Cluster Security for Kubernetes 4.11 1792492060. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-103314 or the next vulnerability affects your stack