CVE-2026-75034

Name of the Vulnerable Software and Affected Versions Rancher versions prior to 2.15.1

Description Rancher Manager contains a flaw in its SAML assertion replay protection. Consumed assertion IDs are recorded in a per-process cache, meaning each replica only detects replays that reach the same pod. In high-availability deployments, an attacker with a captured assertion can replay it against every other replica to obtain multiple authenticated sessions as the victim.

Recommendations Update to version 2.15.1 or later.