CVE-2026-75034

CVE-2026-75034 is a SAML replay-protection weakness in Rancher Manager: the consumed-assertion cache introduced by the fix for CVE-2026-44946 is stored per process, so each replica only detects replays that reach the same pod. In a high-availability deployment, an attacker who captures a valid SAML assertion can replay it once against every other replica, and each replica accepts it because it has never seen the assertion ID. Each successful replay yields an additional authenticated session as the victim, giving the attacker unauthorized access with the victim's privileges (high confidentiality and integrity impact, no availability impact). All Rancher releases before 2.15.1 are affected, but in practice only deployments running multiple replicas with SAML authentication are exposed to this behavior. There is no public proof of concept, no CISA KEV listing, and no known in-the-wild exploitation; EPSS estimates the 30-day exploitation probability at roughly 0.2%.

What to do: Upgrade to Rancher 2.15.1 or later, which is the first version containing the fix. If upgrading is not immediately possible, scale the Rancher server deployment to a single replica (which makes the per-process replay cache fully effective) and restrict network access to the Rancher server; also review authentication logs for multiple concurrent or repeated sessions created for the same SAML user.