{"id":"CVE-2026-12704","aliases":["ALPINE-CVE-2026-12704","BIT-grafana-2026-12704","EUVD-2026-70197","GHSA-xgrw-968j-pp62"],"status":"published","title":"SAML assertion replay via skipped InResponseTo validation","description":"When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00291,"percentile":0.21919,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-294"],"published":"2026-09-02T16:05:42Z","modified":"2026-11-04T22:30:02Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"grafana","fixed_in":["12.4.14-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"grafana","fixed_in":["12.4.11","13.0.8","13.1.5","13.2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.14-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"11.6.0"},{"fixed":"12.4.11"},{"introduced":"13.0.0"},{"fixed":"13.0.8"},{"introduced":"13.1.0"},{"fixed":"13.1.5"},{"introduced":"13.2.0"},{"fixed":"13.2.1"}]}]}],"products":[{"vendor":"grafana","product":"grafana enterprise"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-12704","tags":["vendor-advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12704","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xgrw-968j-pp62"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-12704","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-12704","title":"SAML assertion replay via skipped InResponseTo validation","description":"When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.","status":"published","published":"2026-09-02T16:05:42.965Z","modified":"2026-09-03T08:07:34.086Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T14:19:48.461833Z"}],"euvd":[{"id":"EUVD-2026-70197","description":"When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.","status":"published","published":"2026-09-02T16:05:42Z","modified":"2026-09-03T08:07:34Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:14.198061Z"}],"ghsa":[{"id":"GHSA-xgrw-968j-pp62","title":"When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation...","description":"When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.","status":"published","published":"2026-09-02T18:32:10Z","modified":"2026-09-02T18:32:11Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T15:11:17.291346Z"}],"nvd":[{"id":"CVE-2026-12704","description":"When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.","status":"published","published":"2026-09-02T16:17:14.383Z","modified":"2026-09-03T16:37:52.17Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T14:12:43.399612Z"}],"osv":[{"id":"ALPINE-CVE-2026-12704","description":"When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.","status":"published","published":"2026-09-02T16:17:14.383Z","modified":"2026-11-04T22:30:02.830306935Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-04T22:39:43.298532Z"},{"id":"BIT-grafana-2026-12704","title":"SAML assertion replay via skipped InResponseTo validation","description":"When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.","status":"published","published":"2026-09-08T08:14:50.124Z","modified":"2026-09-09T09:30:05.670541689Z","updated_at":"2026-11-02T15:28:31.02759Z"}]}}