Grafana Enterprise SAML Replay Vulnerability via InResponseTo Skip
CVE-2026-12704 Published on September 2, 2026
SAML assertion replay via skipped InResponseTo validation
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.
Weakness Type
Authentication Bypass by Capture-replay
A capture-replay flaw exists when the design of the software makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). Capture-replay attacks are common and can be difficult to defeat without cryptography. They are a subset of network injection attacks that rely on observing previously-sent valid commands, then changing them slightly if necessary and resending the same commands to the server.
Products Associated with CVE-2026-12704
Want to know whenever a new CVE is published for Grafana Labs Grafana? stack.watch will email you.
Affected Versions
Grafana Enterprise:- Version 11.6.0, <= 11.6.17 is affected.
- Version 12.2.0, <= 12.2.11 is affected.
- Version 12.3.0, <= 12.3.11 is affected.
- Version 12.4.0, <= 12.4.10 is affected.
- Version 13.0.0, <= 13.0.7 is affected.
- Version 13.1.0, <= 13.1.4 is affected.
- Version 13.2.0, <= 13.2.0 is affected.