CVE-2026-12704

6.8 Moyenne

Publiée le 02/09/2026 à 18:17 · Modifiée le 03/09/2026 à 18:37 · En attente d'analyse NVD · Source : security@grafana.com

Description

When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.

Traduire en français

Produits concernés

Grafana Enterprise

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.8 Moyenne	security@grafana.com	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-294

Références

https://grafana.com/security/security-advisories/cve-2026-12704

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories