Ghostwire

CVE-2026-44946: A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler did not enforce...

CRITICAL CVSS 0.0 Exploit Available

Published: June 30, 2026 | Last Modified: June 30, 2026

Description

A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler did not enforce one-time use of SAML assertion, potentially allowing person in the middle attacks against Rancher, affecting Rancher 2.14.0 before 2.14.3,

Ghostwire Analysis — What This Means Practically

Exploit code is reported to be available, increasing the likelihood of active exploitation.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

Security Coverage (1 articles)

References

www.tenable.com/cve/CVE-2026-44946
www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-44946
github.com/rancher/rancher/security/advisories/GHSA-c5jm-xcmq-9j95