Advisoriesby IbisGrafana LabsCVE-2026-12704
Grafana Enterprise: capture-replay
No fix yet
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Grafana Enterprise Product | >= 11.6.0, <= 11.6.17 | No fix yet |
| >= 12.2.0, <= 12.2.11 | No fix yet | |
| >= 12.3.0, <= 12.3.11 | No fix yet | |
| >= 12.4.0, <= 12.4.10 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-294