A flaw was discovered in Red Hat Advanced Cluster Security for Kubernetes where the Central SAML authentication ACS endpoint does not track used SAML assertion or response identifiers. Because of this oversight, an attacker who obtains a valid, unexpired signed SAML response can submit it repeatedly, each time receiving a new Central authentication token bound to the same identity. This replay vulnerability allows a single captured response to be leveraged for multiple distinct access tokens, effectively multiplying the attacker’s authenticated presence within the cluster.

Red Hat Advanced Cluster Security 4 is the affected product. No specific sub‑versions are identified, so all releases within the 4 family are considered vulnerable.

The CVSS score of 7.4 indicates high severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires possession of a valid signed SAML response and the ability to deliver that response to the ACS endpoint, which is inferred to be a remote network activity. Once the response is replayed, the attacker receives fresh authentication tokens, potentially enabling unauthorized access to cluster resources.