CVE-2026-84941: Omada Controller SAML SSO Vulnerability

CVE-2026-84941 Overview

CVE-2026-84941 is an information disclosure vulnerability in the Security Assertion Markup Language (SAML) Single Sign-On (SSO) functionality of TP-Link Omada Controller. The flaw stems from insufficient validation of user-supplied SAML metadata, classified as XML External Entity (XXE) processing [CWE-611]. An authenticated user with SAML configuration privileges can supply crafted metadata that causes the controller to disclose sensitive information. Successful exploitation results in unauthorized access to data the attacker should not be able to read.

Critical Impact
An authenticated administrator with SAML configuration rights can abuse XML parsing to exfiltrate sensitive files or internal resources accessible to the Omada Controller service.

Affected Products

TP-Link Omada Controller (SAML SSO component)
Refer to the vendor advisory for specific fixed builds
Both on-premises and self-hosted Omada Controller deployments

Discovery Timeline

2026-09-11 - CVE-2026-84941 published to the National Vulnerability Database (NVD)
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-84941

Vulnerability Analysis

The vulnerability resides in how the Omada Controller parses SAML metadata XML documents supplied through the SSO configuration interface. When an administrator uploads or references metadata, the XML parser processes the document without disabling external entity resolution. This is a classic XML External Entity (XXE) weakness under [CWE-611]. Because the parser accepts external entity references, attacker-supplied XML can force the server to read local files or reach internal network resources and reflect that content back through the parsing pipeline.

Exploitation requires authenticated access with SAML configuration privileges, which limits the attacker population to users already trusted with identity provider settings. However, in multi-tenant or managed service provider deployments where SSO administration is delegated, this privilege boundary is meaningful and the vulnerability can be used to escalate access to information beyond the intended scope.

Root Cause

The SAML metadata handler instantiates an XML parser with default settings that permit DOCTYPE declarations and external entity resolution. The parser does not restrict SYSTEM or PUBLIC identifiers, allowing entity payloads to point at arbitrary URIs. No allowlist constrains the schemes or paths that the parser may dereference.

Attack Vector

An authenticated attacker navigates to the Omada Controller SSO configuration and submits SAML identity provider metadata that includes a malicious external entity definition. When the controller parses the metadata, the entity is resolved and its content is incorporated into the parsed document. The attacker recovers the referenced content through error messages, reflected fields in the SSO configuration UI, or side channels created by the entity resolution process.

The vulnerability manifests during XML parsing of the SAML metadata upload. See the Omada Networks Document #133722 advisory for vendor technical details.

Detection Methods for CVE-2026-84941

Indicators of Compromise

SAML metadata uploads or edits containing <!DOCTYPE> declarations or <!ENTITY> definitions referencing SYSTEM URIs.
Outbound HTTP, FTP, or file-scheme requests originating from the Omada Controller process shortly after SSO configuration changes.
Unexpected access log entries showing reads of local files such as /etc/passwd, controller configuration files, or credential stores.
Audit log entries for SAML SSO changes performed by administrator accounts outside of normal change windows.

Detection Strategies

Inspect SAML metadata payloads at the web application firewall or reverse proxy for DOCTYPE and external entity constructs before they reach the controller.
Correlate administrator activity on the SSO configuration endpoint with outbound network connections from the controller host.
Alert on any file read syscalls from the Omada Controller service targeting paths outside its expected working directories.

Monitoring Recommendations

Enable and centrally forward Omada Controller audit logs, focusing on SAML configuration events and administrator role changes.
Baseline outbound traffic from the controller and alert on new destinations, especially internal IP ranges not previously contacted.
Track privileged account usage of the SSO settings pages and require review for each modification.

How to Mitigate CVE-2026-84941

Immediate Actions Required

Apply the vendor-supplied fixed Omada Controller build referenced in the vendor advisory.
Restrict the set of accounts with SAML configuration privileges to a minimal, audited group.
Rotate any secrets, API tokens, or credentials stored on the controller filesystem if evidence of SAML metadata tampering exists.
Review recent SAML SSO configuration changes and validate them against approved change tickets.

Patch Information

TP-Link has published guidance and updated Omada Controller software. Download the fixed release from the Omada Controller Software Download page or the US regional download. Full advisory details are available in Omada Networks Document #133722 and the Omada Networks Support Downloads portal.

Workarounds

Temporarily disable SAML SSO configuration for non-essential administrators until the patched build is deployed.
Place the Omada Controller behind a reverse proxy that strips DOCTYPE declarations from XML uploads to the SSO endpoints.
Enforce egress network filtering so the controller host cannot initiate arbitrary outbound connections triggered by XML entity resolution.
Require multi-factor authentication for every account with access to SSO configuration.

bash

# Example egress restriction using iptables to limit outbound HTTP/HTTPS
# from the Omada Controller host to only the required identity provider.
iptables -A OUTPUT -p tcp -d <idp_ip> --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80  -j REJECT
iptables -A OUTPUT -p tcp --dport 443 -j REJECT