# CVE-2026-28809: esaml XXE vulnerability in SAML message parsing

Source: https://junglewise.ai/threats/cve-2026-28809-esaml-xxe-vulnerability-in-saml-message-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-23. Updated: 2026-05-22  
License: CC BY 4.0 with a link back

CVE-2026-28809 · Severity: info · CVSS 6.3 · Published 2026-03-23

esaml is a library used to handle SAML authentication, which allows users to log into multiple services with one set of credentials. A security flaw allows an attacker to send a specially crafted message that forces the server to read sensitive local files, such as system secrets or configuration data. This information could then be leaked through system logs or error messages, potentially compromising the entire environment.

## Quick answers

**Is CVE-2026-28809 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-28809 being exploited in the wild.

**How severe is CVE-2026-28809?** Informational severity, with a CVSS score of 6.3, published 23 March 2026.

**Which products and versions are affected?** Jump-App Esaml <= 4.6.0.

**Is there a fix for CVE-2026-28809?** A patch was published on 2026-03-23: Patch available for Jump-App fork; other forks may remain unpatched. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-28809 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-28809?** Check whether you run Jump-App Esaml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The esaml library and its various forks (arekinath, handnot2, dropbox, Jump-App) are vulnerable to XML External Entity (XXE) injection. The vulnerability exists because the library uses the 'xmerl_scan:string/2' function to parse SAML messages before signature verification occurs, without explicitly disabling external entity expansion. On Erlang/OTP versions prior to 27, the Xmerl parser enables entity expansion by default. An unauthenticated remote attacker can exploit this by sending a malicious SAML document containing external entity references. This can lead to the disclosure of local files (such as Kubernetes secrets) if their contents are reflected in error logs or processed documents, or it can be used to perform SSRF. The issue is mitigated by upgrading to Erlang/OTP 27 or applying patches available for the Jump-App fork.

## Affected products

- Jump-App esaml <= 4.6.0
- arekinath esaml <= 1.1
- handnot2 esaml <= 4.2.0
- dropbox esaml All versions

## Timeline

- 2026-03-23: disclosed
- 2026-03-23: advisory
- 2026-03-23: patched: Patch available for Jump-App fork; other forks may remain unpatched.

## References

- [https://cna.erlef.org/cves/CVE-2026-28809.html](https://cna.erlef.org/cves/CVE-2026-28809.html)
- [https://github.com/Jump-App/esaml/commit/bab85efde7c136911402a881ca55173759467a26](https://github.com/Jump-App/esaml/commit/bab85efde7c136911402a881ca55173759467a26)