CVE-2026-28809 in esaml
Summary
by MITRE • 03/23/2026
XML External Entity (XXE) vulnerability in esaml (and its forks) allows an attacker to cause the system to read local files and incorporate their contents into processed SAML documents, and potentially perform SSRF via crafted SAML messages.
esaml parses attacker-controlled SAML messages using xmerl_scan:string/2 before signature verification without disabling XML entity expansion. On Erlang/OTP versions before 27, Xmerl allows entities by default, enabling pre-signature XXE attacks. An attacker can cause the host to read local files (e.g., Kubernetes-mounted secrets) into the SAML document. If the attacker is not a trusted SAML SP, signature verification will fail and the document is discarded, but file contents may still be exposed through logs or error messages.
This issue affects all versions of esaml, including forks by arekinath, handnot2, and dropbox. Users running on Erlang/OTP 27 or later are not affected due to Xmerl defaulting to entities disabled.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/24/2026
The CVE-2026-28809 vulnerability represents a critical XML External Entity (XXE) flaw in the esaml library and its various forks including those maintained by arekinath, handnot2, and dropbox. This vulnerability stems from the improper handling of SAML messages within the SAML service provider implementation, specifically in how the library processes attacker-controlled input before signature verification. The core issue manifests when the esaml library utilizes xmerl_scan:string/2 function to parse SAML documents without explicitly disabling XML entity expansion, creating a pathway for malicious input manipulation that can lead to unauthorized data access and potential server-side request forgery attacks.
The technical exploitation of this vulnerability occurs through crafted SAML messages that contain malicious XML entities designed to reference local system files or perform server-side requests to internal services. In environments running Erlang/OTP versions prior to 27, the xmerl library defaults to enabling entity expansion, which allows attackers to construct SAML documents that can trigger file system reads and potentially access sensitive information such as Kubernetes-mounted secrets or other local resources. The vulnerability operates at the parsing layer before signature verification occurs, making it particularly dangerous as it can inject arbitrary content into SAML documents that would otherwise be considered trusted, effectively bypassing security controls that rely on proper signature validation.
The operational impact of this vulnerability extends beyond simple information disclosure, as it can enable attackers to access sensitive data that might otherwise be protected by access controls. Even when signature verification fails and documents are discarded, the vulnerability can still expose file contents through error messages or logging mechanisms that capture the parsed content. This exposure creates potential for credential theft, configuration disclosure, and access to internal system resources that could be leveraged for further attacks within the network infrastructure. The vulnerability affects all versions of esaml and its forks, making it particularly widespread across implementations that rely on these libraries for SAML-based authentication.
Organizations utilizing affected versions of esaml should immediately implement mitigations including upgrading to Erlang/OTP 27 or later where Xmerl defaults to disabling entities, or explicitly configuring the XML parser to disable external entity expansion before processing any SAML messages. Security teams should also review and audit their SAML implementation configurations to ensure that entity expansion is disabled and that proper input validation occurs before any parsing operations. Additionally, monitoring systems should be enhanced to detect unusual patterns in SAML message processing that might indicate XXE attack attempts, and logging mechanisms should be reviewed to prevent sensitive data exposure through error messages or audit trails. This vulnerability aligns with CWE-611 (Improper Restriction of XML External Entity Reference) and can be mapped to ATT&CK technique T1071.004 (Application Layer Protocol: DNS) when used for SSRF attacks, and T1005 (Data from Local System) for local file access exploitation.
The broader implications of this vulnerability highlight the importance of proper XML processing security in authentication libraries and the need for comprehensive input validation at multiple layers of application security. Organizations should consider implementing more robust security controls including XML schema validation, proper sandboxing of XML processing, and regular security assessments of third-party libraries to identify similar vulnerabilities that could compromise authentication systems and access controls.