CVE-2026-12704
Fixed in a distro release EPSS <1%CVSS 6.8
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.
Products: Grafana Enterprise
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | grafana-11.6 | no fix |
| Chainguard | grafana-12.1 | no fix |
| Chainguard | grafana-12.2 | no fix |
| Chainguard | grafana-12.3 | no fix |
| Chainguard | grafana-12.4 | 12.4.11-r0 |
| Chainguard | grafana-13.0 | 13.0.9-r0 |
| Chainguard | grafana-13.1 | 13.1.6-r0 |
| Chainguard | grafana-fips-11.6 | no fix |
| Chainguard | grafana-fips-12.1 | no fix |
| Chainguard | grafana-fips-12.2 | no fix |
| Chainguard | grafana-fips-12.3 | no fix |
| Chainguard | grafana-fips-12.4 | 12.4.11-r0 |
| Chainguard | percona-grafana | 0 |
| Wolfi | grafana-12.3 | no fix |
| Wolfi | grafana-12.4 | 12.4.11-r0 |
| Wolfi | grafana-13.0 | 13.0.9-r0 |