Bug 2543879 (CVE-2026-103314)

Summary: CVE-2026-103314 stackrox: stackrox: SAML response replay allows multiple Central authentication tokens
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-10-19   

Description OSIDB Bzimport 2026-09-30 10:52:53 UTC 
A flaw was found in StackRox / RHACS Central. Central accepts the same valid SAML response repeatedly at the SAML Assertion Consumer Service (ACS) endpoint and issues a fresh authentication token each time. The signed SAML response is validated, but consumed response or assertion identifiers are not recorded or rejected afterward. An attacker who obtains a valid, unexpired signed SAML response can replay it to obtain additional distinct Central tokens for the mapped identity. This is not a signature bypass.