CVE-2026-12704 SAML assertion replay via skipped InResponseTo validation
Attackers can replay SAML assertions to hijack user sessions in Grafana Enterprise when IdP-initiated login is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-12704?
CVE-2026-12704 is a medium-severity authentication bypass vulnerability in Grafana Enterprise, published on 2 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.
Weakness: CWE-294
Which versions are affected by CVE-2026-12704?
1 open source package ship an affected version, including grafana.
| Package | Affected | Fixed in |
|---|---|---|
grafana Bitnami | From 11.6.0 | 12.4.11, 13.0.8, 13.1.5, 13.2.1 |
How do I fix CVE-2026-12704?
Upgrade grafana to a fixed version for your release line: 12.4.11, 13.0.8, 13.1.5 or 13.2.1.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-12704 being exploited?
There is no known exploitation of CVE-2026-12704 in the wild and no public exploit code.
Sources
Also known as BIT-grafana-2026-12704, GHSA-xgrw-968j-pp62, MINI-437c-845x-v4qr, MINI-4qgv-j3hj-w3qg, MINI-4wgr-8rxq-5r74, MINI-4whm-7v7h-x5mf and 18 more.