Vulnerability · Published Oct 19, 2026 · Assigned by redhat

CVE-2026-103314Stackrox: stackrox: saml response replay allows multiple central authentication tokens

High 7.4

In plain English

A high-severity security flaw in Red Hat Advanced Cluster Security for Kubernetes 4.10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.4%top 65.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Advanced Cluster Security for Kubernetes 4.10	see references
Red Hat	Red Hat Advanced Cluster Security for Kubernetes 4.11	see references

Weakness: CWE-294 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

RHSA-2026:85932 vendor-advisory, x_refsource_REDHAT
RHSA-2026:92342 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-103314 vdb-entry, x_refsource_REDHAT
RHBZ#2543879 issue-tracking, x_refsource_REDHAT