NCSC-2026-0220

Vulnerability from csaf_ncscnl - Published: 2026-07-03 08:21 - Updated: 2026-07-03 08:21
Summary
Kwetsbaarheden verholpen in Rancher door Rancher Labs
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Rancher Labs heeft kwetsbaarheden verholpen in Rancher versies 2.13.0 tot en met 2.13.7 en 2.14.0 tot en met 2.14.3.
Interpretaties: De eerste kwetsbaarheid betreft een SAML authenticatie replay probleem in de Assertion Consumer Service (ACS) handler in Rancher versies 2.14.0 tot, maar niet inclusief 2.14.3. De ACS handler dwingt het eenmalig gebruik van SAML assertions niet af, waardoor een aanvaller onderschepte assertions kan hergebruiken. Dit kan leiden tot man-in-the-middle aanvallen die de integriteit van het authenticatieproces aantasten. De tweede kwetsbaarheid zit in de legacy Project Role Template Binding reconciler in Rancher versies 2.13.0 tot en met 2.13.7 en 2.14.0 tot en met 2.14.3. Door het ontbreken van een opruimstap kunnen gebruikers Pod Security Admission permissies behouden die eigenlijk ingetrokken hadden moeten worden wanneer een beheerder deze permissies uit een RoleTemplate verwijdert. Dit komt doordat de reconciler permissies niet correct bijwerkt of verwijdert, waardoor ongeautoriseerde toegang kan blijven bestaan en gebruikers mogelijk verhoogde privileges behouden buiten hun toegestane scope.
Oplossingen: Rancher Labs heeft updates uitgebracht om deze kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-281: Improper Preservation of Permissions
CWE-294: Authentication Bypass by Capture-replay
CVE-2026-44946

A SAML authentication replay vulnerability in Rancher's ACS handler allowed potential man-in-the-middle attacks by failing to enforce one-time use of SAML assertions in versions 2.14.0 to before 2.14.3.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-294 - Authentication Bypass by Capture-replay
Affected products
Product Identifier Version Remediation
vers:unknown/*
Rancher / Rancher
 vers:unknown/*
CVE-2026-44947

A missing clean-up in the legacy Project Role Template Binding reconciler in Rancher versions 2.13.0 to 2.13.7 and 2.14.0 to 2.14.3 allowed users to retain unauthorized Pod Security Admission permissions after removal from a RoleTemplate.

CWE-281 - Improper Preservation of Permissions
Affected products
Product Identifier Version Remediation
vers:unknown/*
Rancher / Rancher
 vers:unknown/*
References
To clipboard 

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Rancher Labs heeft kwetsbaarheden verholpen in Rancher versies 2.13.0 tot en met 2.13.7 en 2.14.0 tot en met 2.14.3.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De eerste kwetsbaarheid betreft een SAML authenticatie replay probleem in de Assertion Consumer Service (ACS) handler in Rancher versies 2.14.0 tot, maar niet inclusief 2.14.3. De ACS handler dwingt het eenmalig gebruik van SAML assertions niet af, waardoor een aanvaller onderschepte assertions kan hergebruiken. Dit kan leiden tot man-in-the-middle aanvallen die de integriteit van het authenticatieproces aantasten. De tweede kwetsbaarheid zit in de legacy Project Role Template Binding reconciler in Rancher versies 2.13.0 tot en met 2.13.7 en 2.14.0 tot en met 2.14.3. Door het ontbreken van een opruimstap kunnen gebruikers Pod Security Admission permissies behouden die eigenlijk ingetrokken hadden moeten worden wanneer een beheerder deze permissies uit een RoleTemplate verwijdert. Dit komt doordat de reconciler permissies niet correct bijwerkt of verwijdert, waardoor ongeautoriseerde toegang kan blijven bestaan en gebruikers mogelijk verhoogde privileges behouden buiten hun toegestane scope.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Rancher Labs heeft updates uitgebracht om deze kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Preservation of Permissions",
        "title": "CWE-281"
      },
      {
        "category": "general",
        "text": "Authentication Bypass by Capture-replay",
        "title": "CWE-294"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://github.com/rancher/rancher/security/advisories/GHSA-c4rp-wgqc-mfhc"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://github.com/rancher/rancher/security/advisories/GHSA-c5jm-xcmq-9j95"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Rancher door Rancher Labs",
    "tracking": {
      "current_release_date": "2026-07-03T08:21:34.093014Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0220",
      "initial_release_date": "2026-07-03T08:21:34.093014Z",
      "revision_history": [
        {
          "date": "2026-07-03T08:21:34.093014Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Rancher"
          }
        ],
        "category": "vendor",
        "name": "Rancher"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-44946",
      "cwe": {
        "id": "CWE-294",
        "name": "Authentication Bypass by Capture-replay"
      },
      "notes": [
        {
          "category": "other",
          "text": "Authentication Bypass by Capture-replay",
          "title": "CWE-294"
        },
        {
          "category": "description",
          "text": "A SAML authentication replay vulnerability in Rancher\u0027s ACS handler allowed potential man-in-the-middle attacks by failing to enforce one-time use of SAML assertions in versions 2.14.0 to before 2.14.3.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-44946 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-44946.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-44946"
    },
    {
      "cve": "CVE-2026-44947",
      "cwe": {
        "id": "CWE-281",
        "name": "Improper Preservation of Permissions"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Preservation of Permissions",
          "title": "CWE-281"
        },
        {
          "category": "description",
          "text": "A missing clean-up in the legacy Project Role Template Binding reconciler in Rancher versions 2.13.0 to 2.13.7 and 2.14.0 to 2.14.3 allowed users to retain unauthorized Pod Security Admission permissions after removal from a RoleTemplate.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-44947 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-44947.json"
        }
      ],
      "title": "CVE-2026-44947"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.