CVE-2026-12704

SAML assertion replay via skipped InResponseTo validation

State: Published
Severity: 6.8 Medium
Published: Sep 2, 2026
Updated: Sep 3, 2026
Reserved: Jun 19, 2026

Description

When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N	GRAFANA

Weaknesses

CWE-294

Affected Products

Product	Versions
Grafana EnterpriseGrafana	11.6.0 through 11.6.17Affected 12.2.0 through 12.2.11Affected 12.3.0 through 12.3.11Affected 12.4.0 through 12.4.10Affected 13.0.0 through 13.0.7Affected 13.1.0 through 13.1.4Affected 13.2.0 through 13.2.0Affected

References

https://grafana.com/security/security-advisories/cve-2026-12704vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.