CVE-2026-12704 Overview
CVE-2026-12704 is an authentication weakness in Grafana Enterprise where the SAML library skips validation of the InResponseTo field when Identity Provider (IdP) initiated login is enabled. The flaw removes anti-replay protection on all Security Assertion Markup Language (SAML) responses, including Service Provider (SP) initiated logins. An attacker who obtains a valid signed SAML assertion can replay it to authenticate as the victim user. Only Grafana Enterprise deployments with the allow_idp_initiated SAML setting turned on are affected. The setting is disabled by default, and Grafana OSS is not impacted. The issue is classified as [CWE-294] Authentication Bypass by Capture-Replay.
Critical Impact
An attacker holding a captured signed SAML assertion can replay it against a vulnerable Grafana Enterprise instance and gain a session as the impersonated user.
Affected Products
- Grafana Enterprise instances with SAML authentication enabled
- Grafana Enterprise deployments with allow_idp_initiated = true
- Grafana OSS is not affected
Discovery Timeline
- 2026-09-02 - CVE-2026-12704 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-12704
Vulnerability Analysis
SAML SP-initiated login flows rely on the InResponseTo attribute to bind an incoming SAML response to a specific outbound authentication request. The Service Provider generates a unique request ID, stores it, and expects the returned assertion to reference that ID. This binding is the primary anti-replay control in the SAML profile.
In vulnerable Grafana Enterprise configurations, enabling allow_idp_initiated disables InResponseTo validation globally. The check is skipped for both IdP-initiated and SP-initiated flows. As a result, Grafana accepts any signed assertion that passes signature and audience checks, regardless of whether it corresponds to a live authentication request.
Root Cause
The root cause is an overly broad configuration branch in the SAML library. To support IdP-initiated logins, which by design have no prior AuthnRequest, the code bypasses InResponseTo validation for every incoming response. The intended behavior is to skip the check only for unsolicited IdP-initiated responses while retaining strict validation for SP-initiated flows.
Attack Vector
Exploitation requires an attacker to first obtain a valid signed SAML assertion for the target user. Sources include intercepted browser traffic, malicious IdP-side logging, stolen backups of proxy logs, or a compromised intermediary. The attacker submits the captured assertion to the Grafana Assertion Consumer Service endpoint. Because InResponseTo is not enforced, Grafana treats the replayed response as valid and establishes an authenticated session. User interaction is required to originally produce the assertion, and attack complexity is high because the attacker must acquire a live, unexpired signed assertion.
The vulnerability mechanism is described in the Grafana Security Advisory CVE-2026-12704. No public proof-of-concept code is available at the time of publication.
Detection Methods for CVE-2026-12704
Indicators of Compromise
- Multiple successful SAML logins for the same user from different source IP addresses within a short window
- SAML Response messages arriving at the Assertion Consumer Service without a corresponding outbound AuthnRequest recorded in Grafana logs
- Reuse of the same SAML Assertion ID or Response ID across multiple authentication events
Detection Strategies
- Audit the Grafana configuration for allow_idp_initiated = true under the [auth.saml] section and inventory all Enterprise instances using SAML
- Correlate Grafana authentication events with IdP-side logs to identify sessions that were not preceded by a legitimate authentication request
- Alert on repeated authentication attempts using assertions whose IssueInstant timestamp is outside a narrow freshness window
Monitoring Recommendations
- Forward Grafana authentication and audit logs to a centralized log platform for cross-source correlation with IdP logs
- Track geo-velocity anomalies and concurrent sessions per Grafana user account
- Monitor changes to Grafana SAML configuration files and container environment variables that toggle allow_idp_initiated
How to Mitigate CVE-2026-12704
Immediate Actions Required
- Set allow_idp_initiated = false in the Grafana SAML configuration unless IdP-initiated login is a documented business requirement
- Upgrade Grafana Enterprise to the fixed release identified in the Grafana Security Advisory CVE-2026-12704
- Rotate active Grafana sessions and force reauthentication for all SAML-authenticated users
Patch Information
Grafana Labs has published fixed versions in the Grafana Security Advisory CVE-2026-12704. Administrators should apply the vendor-supplied patch that restores InResponseTo validation for SP-initiated flows while preserving support for IdP-initiated logins where required.
Workarounds
- Disable IdP-initiated SAML login by setting allow_idp_initiated = false until patched binaries can be deployed
- Restrict network access to the Grafana Assertion Consumer Service endpoint to trusted networks and VPN clients
- Shorten SAML assertion validity windows at the IdP to reduce the window in which a captured assertion can be replayed
# Configuration example: disable IdP-initiated SAML in grafana.ini
[auth.saml]
enabled = true
allow_idp_initiated = false
single_logout = true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
