Description
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana Enterprise | 11.6.0 – ≤ 11.6.17, 12.2.0 – ≤ 12.2.11, 12.3.0 – ≤ 12.3.11, 12.4.0 – ≤ 12.4.10, 13.0.0 – ≤ 13.0.7, 13.1.0 – ≤ 13.1.4, 13.2.0 – ≤ 13.2.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | grafana | 12.4.14-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | grafana-12.3 | No fix yet | — |
| Wolfi rolling | grafana-12.4 | 12.4.11-r0 | — |
| Wolfi rolling | grafana-13.0 | 13.0.9-r0 | — |
Advisories 1
- WID-SEC-2026-3190 Grafana Enterprise: Mehrere Schwachstellen ermöglichen Erlangen von Benutzer- oder Administratorrechten BSI CERT-Bund (WID) · Nov 12, 2026
References
- https://grafana.com/security/security-advisories/cve-2026-12704 vendor-advisory