{"schemaVersion":3,"id":"CVE-2026-12704","aliases":["CGA-3cm8-x4q8-j2gq","CGA-3cmh-9m9g-798v","CGA-3j5g-xvmx-mgrf","CGA-3vv8-89pc-6xg5","CGA-45gg-h6vp-rmf7","CGA-6hg4-52f2-823x","CGA-76gg-6f87-qgmw","CGA-7jxp-jfrf-vhmx","CGA-9r2x-mfwh-wvhf","CGA-cg5x-qxgg-7j3h","CGA-h8q9-6hvx-xhf5","CGA-j6rp-jg2r-4w4f","CGA-jm95-25cq-m9fr","CGA-pj8v-w957-fqpv","CGA-qrrp-wc6c-5jh7","CGA-v286-r6cj-3hf4","CGA-v2p6-2588-hxp2","CGA-xj33-2j96-f92f","CGA-2664-q393-c3jv","CGA-2952-mqj7-vqr9","CGA-2x2g-38fm-mv9m","CGA-3j66-g62h-7xp7","CGA-3mh4-hc27-rqfg","CGA-3qjj-9mvh-hc5m","CGA-3v6p-38x9-vx4j","CGA-452x-h8q3-f4x6","CGA-498x-vfvx-v27q","CGA-4cqp-c5rh-7p6p","CGA-4m77-rpg5-wvq4","CGA-5857-xmpf-x4pp","CGA-59hw-64ww-xvcg","CGA-5pcm-j7p9-fcxj","CGA-5vwq-g43m-g65w","CGA-5x9j-p7qv-8m3j","CGA-6899-gm6w-88xp","CGA-6pvm-5vqw-4739","CGA-723m-34pj-r592","CGA-724h-95pv-5qph","CGA-8vqx-2g3v-3w3g","CGA-9c6c-885j-5c72","CGA-9jrq-m7fx-98fv","CGA-9qvc-5gqw-gc9r","CGA-9vjm-4r4v-6vhc","CGA-c8rw-7pqv-5rp3","CGA-c923-ffq4-8569","CGA-cg5f-68cx-rw9j","CGA-f7ff-pchv-798m","CGA-f9cf-m6wq-2c56","CGA-f9j6-35g7-m8f3","CGA-fpqh-72m7-hjg8","CGA-fq6q-qhjj-4c2h","CGA-fqrj-fhfj-4gq6","CGA-g4xg-77wr-j8cw","CGA-g73w-g263-5x9v","CGA-gj26-wr53-hcm9","CGA-h79g-c397-xq3c","CGA-j67g-7mqg-jccw","CGA-j6px-gww4-rcfw","CGA-jfg3-rp2m-72rg","CGA-jg6g-m69g-vm4p","CGA-jq6r-x7m7-h896","CGA-m6r9-vjrm-m5gv","CGA-m96h-3q3f-mhx2","CGA-mxjj-8mm2-qg9r","CGA-pvmw-766q-h4pf","CGA-q7p5-jgj4-qxr7","CGA-qjw3-98c9-fc3f","CGA-qq8p-p83h-f8v6","CGA-qvq6-7mx6-cr7v","CGA-qwhg-q7x2-wvqr","CGA-rphq-pf65-5j9g","CGA-vcf9-8pg2-h4qf","CGA-vg83-33q2-jx3h","CGA-vvr3-5r65-h893","CGA-vwj5-h2j3-cj6q","CGA-w8hw-26g2-wv57","CGA-w9x5-vxfp-m6f9","CGA-wp8g-wjpj-chxh","CGA-x9h8-cqhx-xr87","CGA-xf6r-2995-pcgg"],"status":"published","duplicateOf":null,"title":"SAML assertion replay via skipped InResponseTo validation","description":"When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.","dates":{"published":"2026-09-02T16:05:42.965Z","modified":"2026-09-03T08:07:34.086Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.8,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00273,"percentile":0.18665,"severity":"low","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.00273},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00273,"percentile":0.18665}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00273,"percentile":0.18665}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-294","name":"Authentication Bypass by Capture-replay","description":"A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/294.html"}],"affected":[{"vendor":"chainguard","product":"grafana-11.6","name":"grafana-11.6","label":"grafana-11.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-11.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-12.1","name":"grafana-12.1","label":"grafana-12.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-12.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-12.2","name":"grafana-12.2","label":"grafana-12.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-12.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-12.3","name":"grafana-12.3","label":"grafana-12.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-12.3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-12.4","name":"grafana-12.4","label":"grafana-12.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-12.4","purlType":"apk","versions":[{"text":"< 12.4.11-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 12.4.11-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-13.0","name":"grafana-13.0","label":"grafana-13.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-13.0","purlType":"apk","versions":[{"text":"< 13.0.9-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 13.0.9-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-13.1","name":"grafana-13.1","label":"grafana-13.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-13.1","purlType":"apk","versions":[{"text":"< 13.1.6-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 13.1.6-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-11.6","name":"grafana-fips-11.6","label":"grafana-fips-11.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-11.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-12.1","name":"grafana-fips-12.1","label":"grafana-fips-12.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-12.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-12.2","name":"grafana-fips-12.2","label":"grafana-fips-12.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-12.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-12.3","name":"grafana-fips-12.3","label":"grafana-fips-12.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-12.3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-12.4","name":"grafana-fips-12.4","label":"grafana-fips-12.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-12.4","purlType":"apk","versions":[{"text":"< 12.4.11-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 12.4.11-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"percona-grafana","name":"percona-grafana","label":"percona-grafana","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/percona-grafana","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"grafana-12.3","name":"grafana-12.3","label":"grafana-12.3","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/grafana-12.3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"grafana-12.4","name":"grafana-12.4","label":"grafana-12.4","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/grafana-12.4","purlType":"apk","versions":[{"text":"< 12.4.11-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 12.4.11-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"grafana-13.0","name":"grafana-13.0","label":"grafana-13.0","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/grafana-13.0","purlType":"apk","versions":[{"text":"< 13.0.9-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 13.0.9-r0","eol":null,"hubHref":null},{"vendor":"grafana","product":"grafana enterprise","name":"Grafana Enterprise","label":"grafana enterprise","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 11.6.0, ≤ 11.6.17","noFixRecorded":false,"fixedIn":null},{"text":"≥ 12.2.0, ≤ 12.2.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 12.3.0, ≤ 12.3.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 12.4.0, ≤ 12.4.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 13.0.0, ≤ 13.0.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 13.1.0, ≤ 13.1.4","noFixRecorded":false,"fixedIn":null},{"text":"13.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 11.6.0, ≤ 11.6.17 | ≥ 12.2.0, ≤ 12.2.11 | ≥ 12.3.0, ≤ 12.3.11 | ≥ 12.4.0, ≤ 12.4.10 | ≥ 13.0.0, ≤ 13.0.7 | ≥ 13.1.0, ≤ 13.1.4 | 13.2.0","eol":null,"hubHref":"/vendor/grafana/grafana_enterprise"}],"affectedCount":17,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-12704","label":"grafana.com/security/security-advisories/cve-2026-12704","hostname":"grafana.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-02T16:05:42.965Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-03T08:07:34.086Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":27,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T21:11:32.185Z","stale":false,"partial":false}}