CVE-2026-12704
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.
Risk Assessment
An attacker can hijack a user's session, potentially leading to unauthorized access to data and functions in Grafana.
Recommendation
Disable the allow_idp_initiated setting if not required. Update Grafana Enterprise to a patched version if available.
Other vulnerabilities in Grafana Enterprise
Original NVD description (English source)
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS