CVE-2026-44947
Rancher Labs has fixed vulnerabilities in Rancher versions 2.13.0 to 2.13.7 and 2.14.0 to 2.14.3. The first vulnerability concerns a SAML authentication replay issue in the Assertion Consumer Service (ACS) handler in Rancher versions 2.14.0 to, but not including, 2.14.3. The ACS handler does not enforce the one-time use of SAML assertions, allowing an attacker to reuse intercepted assertions. This can lead to man-in-the-middle attacks that compromise the integrity of the authentication process. The second vulnerability is in the legacy Project Role Template Binding reconciler in Rancher versions 2.13.0 to 2.13.7 and 2.14.0 to 2.14.3. Due to the lack of a cleanup step, users can retain Pod Security Admission permissions that should have been revoked when an administrator removes these permissions from a RoleTemplate. This is because the reconciler does not correctly update or remove permissions, allowing unauthorized access to persist and users to potentially retain elevated privileges outside their allowed scope.
CSIRTS triage
- What
- Vulnerabilities in Rancher allow for SAML authentication replay and improper permission management.
- Who is affected
- Deployments of Rancher versions 2.13.0 to 2.13.7 and 2.14.0 to 2.14.3 are affected.
- Urgency
- Remediation is medium to high urgency due to the potential for exploitation and the impact on authentication integrity.
- Action
- Apply patches immediately.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-44947
Get an email if CVE-2026-44947 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.23% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 14% of all EPSS-scored CVEs.
Advisory coverage (2)
- unknownNCSC-2026-0220 [1.00] [M/H] Vulnerabilities fixed in Rancher by Rancher Labsncsc-nl · 2026-07-03
- unknownCVE-2026-44947: A missing clean-up in the legacy Project Role Template Binding (PRTB) reconciler in Rancher ve…nvd · 2026-06-30
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-44947)