« Volver al listado

CVE-2026-12704

Estado: Pendiente de análisisMedia (6.8)—

When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Grafana — Grafana EnterpriseAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-12704",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-12704",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-02T18:06:37.374630Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@grafana.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "security@grafana.com",
      "affectedData": [
        {
          "vendor": "Grafana",
          "product": "Grafana Enterprise",
          "versions": [
            {
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver",
              "lessThanOrEqual": "11.6.17"
            },
            {
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "12.2.11"
            },
            {
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver",
              "lessThanOrEqual": "12.3.11"
            },
            {
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver",
              "lessThanOrEqual": "12.4.10"
            },
            {
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "13.0.7"
            },
            {
              "status": "affected",
              "version": "13.1.0",
              "versionType": "semver",
              "lessThanOrEqual": "13.1.4"
            },
            {
              "status": "affected",
              "version": "13.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "13.2.0"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-09-02T16:17:14.383",
  "references": [
    {
      "url": "https://grafana.com/security/security-advisories/cve-2026-12704",
      "source": "security@grafana.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@grafana.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-294"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected."
    }
  ],
  "lastModified": "2026-09-03T16:37:52.170",
  "sourceIdentifier": "security@grafana.com"
}