CVE-2026-12704 in Grafana
Summary
by MITRE • 09/02/2026
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability in question stems from an improper validation of security tokens within the Security Assertion Markup Language implementation used by Grafana Enterprise, specifically when the IdP-initiated login feature is active. In standard SAML authentication flows, the Service Provider generates a unique identifier known as the Request ID and includes it in the initial authentication request sent to the Identity Provider. Upon receiving the response, the Service Provider must verify that the InResponseTo field of the received assertion matches this original Request ID. This mechanism serves as a critical anti-replay control, ensuring that the response is directly linked to a specific, recent login attempt initiated by the user or system. However, in Grafana Enterprise versions where the allow_idp_initiated setting is enabled, the underlying SAML library incorrectly bypasses this validation step for all incoming responses, regardless of whether they originate from an IdP-initiated flow or a Service Provider-initiated flow. This oversight effectively nullifies the integrity check that ties the assertion to its specific context, creating a significant security gap in the authentication pipeline.
From a technical perspective, the flaw represents a classic failure to validate input data against expected state constraints, which aligns with CWE-20 Improper Input Validation and more specifically CWE-345 Insufficient Verification of Data Authenticity. By skipping the check on the InResponseTo field, the application fails to ensure that the assertion is fresh and intended for the current session context. This design error allows an attacker who has intercepted or otherwise obtained a valid, signed SAML assertion from a previous authentication event to reuse it in a new login attempt. Since the signature verification remains intact, the Identity Provider's cryptographic guarantees are not violated; rather, the Service Provider fails to enforce temporal and contextual binding between the request and response. This is particularly dangerous because SAML assertions often contain sensitive user identity information and can be valid for extended periods depending on configuration settings such as NotOnOrAfter timestamps.
The operational impact of this vulnerability is severe, primarily facilitating unauthorized access through session replay attacks. An attacker who manages to capture a legitimate signed assertion from network traffic or logs can present it to the Grafana Enterprise instance at any later time before the assertion expires. Upon submission, the system will accept the assertion as valid and establish a new authenticated session for the victim user without requiring their credentials again. This effectively bypasses multi-factor authentication if the initial login involved MFA, allowing persistent access under the compromised identity. The attack does not require exploitation of complex buffer overflows or code injection techniques; it relies solely on the logical flaw in token validation, making it straightforward to execute and difficult to detect through traditional signature-based intrusion detection systems that do not monitor for replay patterns specifically.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The most direct solution is to disable the allow_idp_initiated setting if IdP-initiated logins are not strictly required by organizational workflows, as this restores the default behavior where InResponseTo validation is enforced across all SAML responses. For environments that require IdP-initiated flows, it is imperative to apply vendor-provided patches or updates that correct the library's logic to properly validate the InResponseTo field even in these specific scenarios. Additionally, organizations should implement network-level controls such as strict session timeout policies and short assertion validity periods to reduce the window of opportunity for replay attacks. Monitoring tools should be configured to detect multiple login attempts using identical assertions from different source IPs or at unusual times, which may indicate an ongoing exploitation attempt aligned with ATT&CK technique T1078 Valid Accounts and specifically the sub-technique of Replaying Authentication Credentials.