Executive brief
Grafana Enterprise's SAML authentication feature can be exploited to replay valid login assertions when IdP-initiated login is enabled (a non-default setting). An attacker who intercepts a legitimate SAML login token can reuse it to impersonate the victim and gain unauthorized access to the Grafana instance, potentially exposing dashboards, data sources, and other sensitive observability configurations.
Technical details
The vulnerability is a replay attack in SAML authentication caused by improper validation of the InResponseTo field. When the allow_idp_initiated SAML configuration option is enabled, the underlying SAML library fails to validate the InResponseTo field on SAML responses, removing anti-replay protection for both IdP-initiated and SP-initiated login flows. An attacker who obtains a valid, signed SAML assertion (e.g., through network sniffing or intercepted traffic) can replay it to establish a session as the victim user without needing to interact with the IdP. The attack requires user interaction during the initial legitimate login but does not require authentication or privileges. This issue affects Grafana Enterprise only; Grafana OSS and instances with the allow_idp_initiated setting disabled are not vulnerable. Patches are available in versions 11.6.0, 13.0.8, 13.1.5, and 13.2.1 or later.
Affected products
- Grafana Grafana Enterprise <11.6.0, >=12.4.11 <13.0.0, >=13.0.8 <13.1.0, >=13.1.5 <13.2.0, >=13.2.1
Timeline
- 2026-09-02: disclosed