A flaw in Rancher Manager allows an attacker who has captured a valid SAML assertion to replay that assertion multiple times, once against each replica in a high‑availability deployment. The protection introduced by the prior fix stored consumed assertion IDs only in a per‑process cache, so replay detection never propagated across pods. The attacker can therefore create additional authenticated sessions as the victim, effectively bypassing intended single‑use authentication constraints without executing code. This results in unauthorized access to the victim’s Rancher account and any resources the account can reach. The weakness is an improper authentication flaw (CWE‑294).

All Rancher Manager deployments of SUSE Rancher older than version 2.15.1 that run in a high‑availability configuration with multiple replicas are affected. This includes any installation where the per‑process cache is not shared across pods, which is the default for standard HA setups.

The CVSS score of 7.4 classifies the vulnerability in the high severity range. EPSS data is not available, but the flaw is not listed in the CISA KEV catalog. The likely attack vector is remote: an adversary must intercept or otherwise obtain a valid SAML assertion and then replay it, which can be achieved through interception of IDP traffic or via a compromised application that registers the user. Because the attacker can gain an additional authenticated session per replica, the impact scales with the number of pods, increasing the potential exposure. Overall, the risk of exploitation is moderate to high for environments lacking the latest fix.