CVE-2026-12704: CVE Record
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allowidpinitiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure Grafana’s SAML setting allow_idp_initiated is disabled. Only instances with allow_idp_initiated enabled are affected; it is off by default.
Grafana Enterprise (SAML) allow_idp_initiated = off - Compensating control
If SAML IdP-initiated login must remain enabled temporarily, add compensating controls to limit the ability to replay stolen SAML assertions (e.g., restrict/monitor SAML login attempts and require additional authentication/controls for sensitive actions), since anti-replay protection is removed and InResponseTo validation is skipped.
Event History
Frequently Asked Questions
Which deployments are affected?
Only Grafana Enterprise instances with the SAML allow_idp_initiated setting enabled are affected. The setting is disabled by default, and Grafana OSS is not affected.
What does an attacker need to exploit this issue?
An attacker needs to obtain a valid signed SAML assertion for a victim user and replay it. User interaction is required according to the CVSS vector.
How can I determine whether my instance is exposed?
Check whether the deployment is Grafana Enterprise and whether its SAML allow_idp_initiated setting is enabled. Instances where that setting remains disabled are not affected.