Description

When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-02T16:17:14.383Z",
  "pubdate": "2026-09-02T16:17:14.383Z",
  "executiveSummary": "This vulnerability involves a failure in the SAML authentication flow within Grafana Enterprise, specifically concerning the validation of the 'InResponseTo' attribute in SAML assertions.\nThe issue is classified as an improper validation of cryptographic signatures or state-tracking mechanisms, which effectively disables anti-replay protections for SAML-based authentication.\nThe vulnerability affects Grafana Enterprise instances where 'allow_idp_initiated' SAML authentication is explicitly enabled, a configuration that is disabled by default.\nBy bypassing the mandatory validation of the 'InResponseTo' field, an attacker who intercepts a valid, signed SAML assertion can replay the assertion to the Service Provider (SP).\nSuccessful exploitation allows an unauthorized actor to masquerade as a legitimate user, potentially gaining full session access to the victim's account.\nThe risk is significant for organizations relying on SAML for enterprise SSO, as it undermines the integrity of the authentication assertion exchange.\nExploitation requires the attacker to possess a previously valid signed SAML assertion, necessitating potential interception or leakage of the assertion from the identity provider-to-user communication channel.\nGrafana OSS editions are confirmed to be unaffected by this specific vulnerability.",
  "technicalDetails": "The root cause of this vulnerability lies in the logic governing the SAML response processor within Grafana Enterprise. When the 'allow_idp_initiated' configuration flag is set to true, the integrated SAML library alters its standard validation routine by opting to skip the verification of the 'InResponseTo' field across all SAML assertions.\nIn the SAML 2.0 protocol, the 'InResponseTo' attribute acts as a critical security anchor in SP-initiated authentication flows. It serves as a state-tracking mechanism where the SP includes an ID in the AuthnRequest sent to the IdP. The IdP, in turn, includes this ID in the 'InResponseTo' field of the corresponding SAML response. By verifying this ID, the SP ensures that the received assertion is a direct and intended response to an active, legitimate request originated by that specific SP.\nBy neglecting to validate this field, the application loses the ability to distinguish between a unique, single-use response and an assertion that has been previously intercepted and replayed. Effectively, the SP treats any properly signed SAML assertion as valid, regardless of whether it corresponds to a current authentication request.\nThe attack flow proceeds as follows: First, an attacker intercepts a legitimate SAML assertion generated by the IdP for a target user (e.g., via network sniffing, logs, or man-in-the-middle positioning). Second, because the Grafana Enterprise instance is configured with 'allow_idp_initiated' set to true, the security library fails to check the 'InResponseTo' attribute. Third, the attacker submits the captured SAML assertion to the Grafana authentication endpoint. Finally, the service accepts the replayed assertion as a valid authentication token, establishing an active user session in the context of the victim, granting the attacker the privileges associated with that identity.\nThis vulnerability bypasses standard anti-replay mechanisms, which are foundational to secure federated authentication. Because the assertion remains signed by the trusted IdP, the Grafana instance accepts it without temporal validation or correlation to an existing session state. This allows for session hijacking or unauthorized access to sensitive internal resources protected by the Grafana installation. The vulnerability affects all authentication modes (both SP-initiated and IdP-initiated) whenever the global setting for IdP-initiated login is toggled active, as the logic change is applied globally to the SAML library's processing pipeline."
}