A flaw in Rancher’s Assertion Consumer Service does not enforce one‑time use of SAML assertions, allowing an attacker to replay a captured assertion for additional authentications. The effect of this flaw is that an adversary can gain unauthorized access to Rancher’s administrative interface or other privileged actions without needing credentials. The weakness is classified as CWE‑294, reflecting a failure to protect the integrity of authentication data.

SUSE Rancher services 2.14.0 through the build before 2.14.3 are vulnerable. The issue was fixed in the 2.14.3 release and later versions.

The CVSS score of 9.5 marks this as critical, and while the EPSS score is not available, the lack of a KEV listing does not diminish the likelihood of exploitation. The vulnerability can be leveraged remotely over the network by intercepting a valid SAML response, making it suitable for a man‑in‑the‑middle scenario. Exploitation would require interception of traffic or access to a session where a SAML assertion was previously issued.