CVE-2026-12704: SAML assertion replay via skipped InResponseTo validation

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-02 · updated 2026-09-03
Weakness: CWE-294

Description

When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.

Affected products

Grafana: from 11.6.0 through 11.6.17; from 12.2.0 through 12.2.11; from 12.3.0 through 12.3.11; from 12.4.0 through 12.4.10; from 13.0.0 through 13.0.7; from 13.1.0 through 13.1.4

References

https://grafana.com/security/security-advisories/cve-2026-12704

Get alerted when CVE-2026-12704 or the next vulnerability affects your stack