RHSA-2026:85932HighCVSS 7.4

Red Hat Security Advisory: RHACS 4.11.6 security and bug fix update

Published
October 20, 2026
Last Modified
October 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-103314 →

📋 Description

CVE-2026-103314 — stackrox: stackrox: SAML response replay allows multiple Central authentication tokens

🎯 Affected products48

  • Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel9@sha256:0fe2b7d2e97e11f76ed77b5bf4234b95731c26baa34819b103b9b233a6b5b6f3_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel9@sha256:5e99d21f25b1bb590279d377e6752df48e4dfafa87b5ae6e912e85c96d0caaa2_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel9@sha256:f1fc76880a216f9ebc7a803e209f07b81c06316c5055584a833ac2ad32676bf3_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel9@sha256:f99a8bea22111623e236d200a6034f9e6b380d5f8c5d8a695fbe1a190d5e180e_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel9@sha256:556e2cfc0df0ae76c17229bdba62b0dc41456a3f896deacdc7c312dc4311c8e1_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel9@sha256:92a3969bc2f4d16de9ff877193cbb267deabfd19cc84467d24c822869fddfd13_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel9@sha256:a00af07321940d4238c045762a6b6c14abc48eb18a80bcc4bb83c8947a104618_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel9@sha256:d969a1f86eecb9857bc940506cb7840762f25a599b329d6249795978fcb7a738_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-fact-rhel9@sha256:337de328cebacf3d52b8075e0aef650f1e6573a040e288dcd996d94fda794e9c_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-fact-rhel9@sha256:4aae13b5a58497c4d8ac049a0695166cc910a52925c778e7f93f072c4ff46bd3_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9@sha256:9368b01af83707cfb366ab425be139403743bf12345af98ee952da548de78218_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9@sha256:bc56bf561f0f7a966104e67c907788701867f99f101ed69bebd2dbffeaadcf14_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9@sha256:cb075faf162b9235dcd336b6108bf365e9cdb63ce2fd40b5483f4bcd8895665c_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9@sha256:ea407caa5c3c5d7e88d619e5ac5067b5d690fc765b164077db2d5f25aa35b1a6_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle@sha256:4b0fb777f6d68a33c8ac72efa247c9fe76877d8392f9ca88e96bfc3e4ad60936_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator@sha256:06b7170d52ae89374c0bdc8ea8c0f5f49f0fe2f00a2d2e2876071c1d624b8ffa_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator@sha256:47ebf7ebb980d20a6cc94bf5debccde6a24662d128a2fda8e5cd794edbd04dd1_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator@sha256:532c84d6da58313632c82dafc30378a1c246ae160bb9f982a1841acaa47f5d57_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator@sha256:e22ec2844d4a74886d405d2d1840eacdc7e875a9bb6dd4fae0fd141f609dcd7f_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel9@sha256:252f262271525dd89f165bf78bfe5c02f2a32a0e6d43b77a64b032ec46632873_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel9@sha256:8ba5444b75f2c666478af385a4dd6de0d7fb70c3841fec0ef375d39d24d61880_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel9@sha256:d3e56c09eb89a6a287c5c4e7da5cb803358999950546d8d29f6f6e74d16c8274_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel9@sha256:f48c84473b544700903273e59d488bc4b644c0d7d8e394744f92d89b8f52aade_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel9@sha256:2ff60c4d3dcd41938f402a6bdb22334d0a2c00a8e1ed42f6c4284176c2773eba_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel9@sha256:3a42a6fb4a86b15af383cfa1adb7efb5a4fa2ee634f846dfed848c7f9a342365_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel9@sha256:4295636c43cbbed33edbce5be22e1ae1fdddf9f5cc23ce16706f2f6d46c55562_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel9@sha256:fb3c2dc0905de2e7abcabe616a1ec61a60817dcc035932ca55c43190d1bbadad_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel9@sha256:3a4d9edc834ca0260080dcc33aa4ba387f0d8d7b0dc75081b84e0c1a1eefa8a1_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel9@sha256:b56e3fe5f700ace22f8f0f540daf8a13ae58d98f6231e0c8df7cfcdd7fcec6fe_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • +18 more not shown

✅ Remediation

If you are using an earlier version of RHACS, you are advised to upgrade to the version of RHACS mentioned in the synopsis and release notes in order to take advantage of the enhancements, bug fixes, and/or security patches in the release. Workaround: Until an update is available, restrict network access to the Central SAML ACS endpoint to trusted identity providers and networks, and reduce SAML assertion lifetimes at the identity provider where possible. --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce replay tracking on the Central SAML Assertion Consumer Service endpoint to record and reject previously consumed assertion and response identifiers: upgrade to RHACS 4.11.6 (or the fixed Advanced Cluster Security/Rhacs Main Rhel builds), which record and reject previously consumed SAML response and assertion identifiers at the ACS endpoint, closing all 2 injection vectors (SAML response replay, SAML assertion identifier reuse). Until patched, this is only a concern on RHACS Central deployments on Linux with SAML authentication enabled and a reachable ACS endpoint — Deployments that do not use SAML authentication or rely on OIDC ID-token logins are unaffected — so Restrict network access to the Central SAML ACS endpoint to trusted identity providers and networks, and reduce SAML assertion lifetimes at the identity provider. As a compensating measure, Configure host-based firewall rules using firewalld or nftables to restrict reachability to the Central SAML ACS endpoint to authorized identity providers and trusted client subnets and Apply network segmentation via VLANs or subnets to isolate the network path to RHACS Central and restrict reachability to the SAML ACS endpoint. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing SAML replay protection defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-202 Host-Based Firewall (firewalld/nftables) (medium)

🔗 References (5)