Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN697 _____________________________________________________________________ DATE : 30/06/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running rancher (Go) versions prior to 2.14.3, 2.13.7, 2.12.11, 2.11.15. ===================================================================== https://github.com/rancher/rancher/security/advisories/GHSA-c5jm-xcmq-9j95 https://github.com/rancher/rancher/security/advisories/GHSA-c4rp-wgqc-mfhc _____________________________________________________________________ SAML Authentication Replay in Rancher High samjustus published GHSA-c5jm-xcmq-9j95 Package github.com/rancher/rancher (Go) Affected versions >=2.14.0, <2.14.3 >=2.13.0, <2.13.7 >=2.12.0, <2.12.11 >=2.11.0, <2.11.15 Patched versions 2.14.3 2.13.7 2.12.11 2.11.15 Description Impact A SAML authentication replay vulnerability exists in Rancher's Assertion Consumer Service (ACS) handler. Rancher's SAML login does not enforce one-time use of SAML assertions: the same signed SAML response can be submitted more than once to obtain separate authenticated sessions. This vulnerability affects all SAML-based authentication providers supported by Rancher, including Okta, Ping, ADFS, Keycloak, and Shibboleth, because they all share the same ACS handler (pkg/auth/providers/saml/saml_client.go). Preconditions: Successful exploitation requires the following conditions: Rancher is configured to use a SAML-based authentication provider. The attacker can obtain a valid, signed SAML response issued during a victim's authentication flow (for example, through network interception, access to logs containing authentication artifacts, or by leveraging another vulnerability such as XSS). The attacker can obtain the victim's corresponding pre-authentication SAML state cookie. An attacker who meets these prerequisites can replay the captured SAML response together with the associated state cookie to establish a new authenticated Rancher session as the victim. The resulting session inherits all permissions assigned to the victim account, including administrative privileges where applicable, enabling full impersonation of the affected user. Patches The fix adds server-side tracking of SAML assertion IDs. When a SAML assertion is processed, its ID is stored in an in-memory cache. The cache entry expires at the assertion's NotOnOrAfter time (or after one hour if no expiry is specified). Any subsequent submission of the same assertion ID is rejected. Additionally, the fix enforces strict validation of the SAML assertion's NotBefore and NotOnOrAfter time conditions, rejecting assertions that fall outside their validity window. These changes are applied in the shared ACS handler and therefore protect all SAML providers (Okta, Ping, ADFS, Keycloak, Shibboleth) simultaneously. Rancher v2.14.3, v2.13.7, v2.12.11 and v2.11.15, include the fix for this issue. Workarounds There is no complete workaround for users who cannot upgrade. As a partial mitigation, reducing the SAML assertion validity window at the Identity Provider level limits the time window in which a captured assertion can be replayed. Restricting network access to the Rancher SAML ACS endpoint and enforcing TLS inspection between clients and Rancher reduces the practical feasibility of intercepting SAML traffic, but does not eliminate the vulnerability. Credits This vulnerability was responsibly disclosed by Austin Chu, Sohee Kim, and Corban Villa as part of a U.C. Berkeley security research project. References If you have any questions or comments about this advisory: Reach out to the SUSE Rancher Security team for security related inquiries. Open an issue in the Rancher repository. Verify our support matrix and product support life cycle. Severity High 7.4/ 10 CVSS v3 base metrics Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged Confidentiality High Integrity High Availability None CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE ID CVE-2026-44946 Weaknesses Weakness CWE-294 _____________________________________________________________________ Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher Moderate samjustus published GHSA-c4rp-wgqc-mfhc Package github.com/rancher/rancher (Go) Affected versions >=2.14.0, <2.14.3 >=2.13.0, <2.13.7 Patched versions 2.14.3 2.13.7 Description Impact A vulnerability in the legacy Project Role Template Binding (PRTB) reconciler in Rancher allows users to retain unauthorized Pod Security Admission (PSA) permissions after an administrator removes those permissions from a RoleTemplate. When the aggregated-roletemplates feature is disabled (the default configuration), removing the updatepsa permission from a RoleTemplate does not trigger cleanup of the associated PSA ClusterRole and ClusterRoleBinding. As a result, the affected user retains the ability to modify PSA enforcement levels across project namespaces even after explicit revocation. Stale permissions persist indefinitely, surviving both RoleTemplate downgrades and subsequent deletion of the PRTB. Preconditions For this vulnerability to be exploitable, all of the following must apply: The Rancher installation uses the legacy PRTB reconciler, i.e., the aggregated-roletemplates feature flag is disabled (this is the default behavior). An administrator has previously created a RoleTemplate that grants the updatepsa permission (verb: updatepsa, resource: project, apiGroup: management.cattle.io) and assigned it to a user via a PRTB. The administrator subsequently removes the updatepsa permission from the RoleTemplate without manually deleting the user's PSA ClusterRoleBinding. Notes: The aggregated-roletemplates handler (when enabled) performs desired-state reconciliation and is not affected by this issue. Rancher versions 2.12 and 2.11 are not receiving a patch for this security issue. Please review the workarounds section below for proper mitigations. Patches The legacy PRTB reconciler has been updated to correctly clean up stale PSA ClusterRoles and ClusterRoleBindings when the updatepsa permission is removed from a RoleTemplate. The ensurePSAPermissions() function in pkg/controllers/managementuser/rbac/prtb_handler.go now invokes the cleanup path when the permission is no longer present, ensuring that PSA artifacts are removed during reconciliation. The following versions of Rancher contain the fix: 2.14.3 and 2.13.7. Workarounds For environments that cannot immediately upgrade, administrators can mitigate the issue by manually identifying and deleting stale PSA ClusterRoles and ClusterRoleBindings after downgrading a RoleTemplate that previously granted updatepsa. The ClusterRoles will be of the form -namespaces-psa. Delete any ClusterRoles with that name and any ClusterRoleBindings that reference the ClusterRoles for RoleTemplates that should no longer have updatepsa permissions. Credits This vulnerability was discovered and reported by bugbunny.ai. For more information If you have any questions or comments about this advisory: Reach out to the SUSE Rancher Security team for security related inquiries. Open an issue in the Rancher repository. Verify our support matrix and product support life cycle. Severity Moderate 4.9/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged Confidentiality None Integrity High Availability None CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N CVE ID CVE-2026-44947 Weaknesses Weakness CWE-281 ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================