A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a captured assertion could replay it once against every other replica to obtain additional authenticated sessions as the victim. This issue affects Rancher: before 2.15.1.

A flaw was discovered in Rancher Manager where the SAML assertion replay protection, introduced as a fix for CVE-2026-44946, used a per-process in-memory cache to track consumed assertion IDs. In high-availability deployments with multiple replicas, this means each pod only detects replays routed to itself. An attacker who captures a valid SAML assertion can replay it against every other replica in the cluster, obtaining additional authenticated sessions as the victim user. This effectively bypasses the replay protection in distributed environments. The vulnerability affects all Rancher versions prior to 2.15.1. The fix requires upgrading to Rancher 2.15.1 or later, which presumably implements a shared or distributed cache for assertion ID tracking. This is a significant authentication bypass issue in enterprise Kubernetes management environments.