CVE Feed

    Dashboard / CVE / CVE-2026-12704

    CVE-2026-12704

    When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.

    Published:Sep 2, 2026
    Last Modified:Sep 3, 2026
    EPS:Sep 2, 2026
    EPSS Score:0.00273
    CVSS Score:6.8

    Affected Products

    Vendor
    Grafana
    Product
    Grafana Enterprise

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-14199 (CVSS 7.1) — Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl grea…
    CVE-2026-19197 (CVSS 6.3) — A user with organization administrator permissions can delete dashboard snapshots belonging to other organizat…
    CVE-2026-11817 (CVSS 5.3) — This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization dep…
    CVE-2026-28378 (CVSS 3.1) — The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one o…
    CVE-2026-42127 (CVSS 7.5) — The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticat…
    CVE-2026-27876 (CVSS 9.1) — A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execu…
    CVE-2025-41117 (CVSS 6.8) — Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScrip…
    CVE-2026-21722 (CVSS 5.3) — Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of…
    CVE-2026-21721 (CVSS 8.1) — The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permis…
    CVE-2026-21720 (CVSS 7.5) — Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High