CVE-2026-12704: SAML assertion replay via skipped InResponseTo validation
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allowidpinitiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable SAML IdP-initiated login by setting 'allow_idp_initiated SAML' to off/false to avoid the SAML library skipping InResponseTo validation on SAML responses.
Grafana Enterprise allow_idp_initiated SAML = false
Event History
Frequently Asked Questions
Which deployments are affected?
Only Grafana Enterprise instances with the SAML allow_idp_initiated setting enabled are affected. The setting is disabled by default, and Grafana OSS is not affected.
What does an attacker need to exploit this issue?
An attacker needs to obtain a valid signed SAML assertion for a victim user and replay it. User interaction is required according to the CVSS vector.
How can I determine whether my instance is exposed?
Check whether the deployment is Grafana Enterprise and whether its SAML allow_idp_initiated setting is enabled. Instances where that setting remains disabled are not affected.