Skip to content
Fencer Intel
high 7.4

CVE-2026-103314 json

Stackrox: stackrox: saml response replay allows multiple central authentication tokens

published 21d ago modified 9d ago also EUVD-2026-104252

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits
0
none known

Summary

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.

Patch / fix

  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10 1793184257
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.11 1792492060

Is CVE-2026-103314 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-103314 updated cvss 7.4

stackrox: stackrox: SAML response replay allows multiple Central authentication tokens

  • Red Hat Advanced Cluster Security for Kubernetes 4.10 advanced-cluster-security/rhacs-main-rhel8 1793184257
    fixed: vendor fix RHSA-2026:92342
  • Red Hat Advanced Cluster Security for Kubernetes 4.11 advanced-cluster-security/rhacs-main-rhel9 1792492060
    fixed: vendor fix RHSA-2026:85932
  • Red Hat Advanced Cluster Security for Kubernetes 4.10 advanced-cluster-security/rhacs-fact-rhel8 1792993727, advanced-cluster-security/rhacs-roxctl-rhel8 1793184257, advanced-cluster-security/rhacs-scanner-rhel8 1792902933, advanced-cluster-security/rhacs-rhel8-operator 1793184257, advanced-cluster-security/rhacs-collector-rhel8 1792997929, advanced-cluster-security/rhacs-operator-bundle 1793184257, +6 more Red Hat Advanced Cluster Security for Kubernetes 4.11 advanced-cluster-security/rhacs-fact-rhel9 1792136948, advanced-cluster-security/rhacs-roxctl-rhel9 1792492060, advanced-cluster-security/rhacs-scanner-rhel9 1792128401, advanced-cluster-security/rhacs-rhel9-operator 1792492060, advanced-cluster-security/rhacs-collector-rhel9 1792124070, advanced-cluster-security/rhacs-operator-bundle 1792492060, +6 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
21d ago

Exploit prediction

0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.11

Classification

Weakness
  • CWE-294 Authentication Bypass by Capture-replay

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.