Cpe:2.3:a:redhat:advanced_cluster_security_for_kubernetes:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aredhatadvanced_cluster_security_for_kubernetes/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 19 Oct 2026 14:09:16 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSAML Authentication Replay Vulnerability in Red Hat Advanced Cluster Securityhttps://feed.craftedsignal.io/briefs/2026-10-rhacs-saml-replay/Mon, 19 Oct 2026 14:09:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-rhacs-saml-replay/Red Hat Advanced Cluster Security for Kubernetes contains a SAML authentication flaw allowing attackers to replay unexpired assertions to obtain multiple valid session tokens.A vulnerability, tracked as CVE-2026-103314, exists in Red Hat Advanced Cluster Security (RHACS) for Kubernetes regarding the Central component's SAML authentication process. The issue stems from the failure of the SAML assertion endpoint to properly track or invalidate SAML assertion and response identifiers once they have been processed. Consequently, an attacker who manages to intercept a legitimate, unexpired signed SAML response can successfully replay that response against the Central authentication endpoint multiple times. This leads to the generation of distinct and valid Central authentication tokens for the targeted identity. This vulnerability poses a significant risk to organizational access control, potentially enabling unauthorized persistent access to the Kubernetes security management plane.

Impact

Successful exploitation of this flaw allows an attacker to bypass authentication controls by reusing valid session artifacts. If an attacker gains access to an authenticated SAML response, they can generate multiple valid sessions, effectively extending their access window or escalating privileges by impersonating the identity associated with the captured assertion. This affects the security integrity of the RHACS Central service, which is critical for enforcing security policies across managed Kubernetes clusters.

Recommendation

Prioritize the identification of Red Hat Advanced Cluster Security instances within the environment. Monitor the vendor advisory portal for the release of security patches addressing CVE-2026-103314 and schedule an immediate upgrade to the patched version once available. Given the nature of the vulnerability, implement strict network-level controls and mTLS for communication paths involving the Central authentication endpoint to reduce the likelihood of SAML assertion interception. Review SAML configuration settings to minimize the validity window of assertions, reducing the time frame during which an intercepted assertion could be replayed.

]]>highadvisoryvulnerabilitycloud-securitysamlauthentication-bypass