CVE-2026-12704

SAML assertion replay via skipped InResponseTo validation

MEDIUM

6.8

CVSS Score

Published: September 2, 2026 at 04:05 PM UTC

Updated: September 3, 2026 at 04:54 PM UTC

1 product affected across 1 vendorGrafana

Using Grafana Enterprise by Grafana?

Get instant alerts when new vulnerabilities affect Grafana Enterprise - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.8

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Grafana · Grafana

60%

11.6.0 ≤ v ≤ 11.6.1712.2.0 ≤ v ≤ 12.2.1112.3.0 ≤ v ≤ 12.3.1112.4.0 ≤ v ≤ 12.4.1013.0.0 ≤ v ≤ 13.0.713.1.0 ≤ v ≤ 13.1.411.6.0 12.2.0 12.3.0 12.4.0 13.0.0 13.1.0 13.2.0