CVE-2026-103314

{
  "etk_id": "ETK-2026-2095",
  "cve_id": "CVE-2026-103314",
  "display_id": "CVE-2026-103314",
  "ghsa_id": "GHSA-xxr5-h8gc-q63j",
  "euvd_id": "EUVD-2026-104252",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SAML response replay in Advanced Cluster Security",
  "summary": "Red Hat Advanced Cluster Security deployments using Central SAML authentication are affected. An attacker who obtains a still-valid signed SAML response can replay it to receive additional Central authentication tokens for the associated identity.",
  "mitigation": "Disable Central SAML authentication where operationally feasible and use an alternative authentication method until an update is available. Limit access to SAML responses and their handling systems to reduce the chance that reusable responses are obtained.",
  "vendor": "Red Hat",
  "product": "Red Hat Advanced Cluster Security 4",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "advanced-cluster-security/rhacs-main-rhel8",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "advanced-cluster-security/rhacs-main-rhel9",
      "purl": null
    }
  ],
  "cwes": [
    294
  ],
  "cvss_score": 7.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": 0.0026,
  "epss_percentile": 0.1712,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 26.81183085,
  "t0_at": "2026-10-19T12:14:27.338000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-19T12:14:27.338000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T12:14:27.338000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103314"
    }
  }
}