CVE-2026-28809 Details
Description
XML External Entity (XXE) vulnerability in esaml (and its forks) allows an attacker to cause the system to read local files and incorporate their contents into processed SAML documents, and potentially perform SSRF via crafted SAML messages. esaml parses attacker-controlled SAML messages using xmerl_scan:string/2 before signature verification without disabling XML entity expansion. On Erlang/OTP versions before 27, Xmerl allows entities by default, enabling pre-signature XXE attacks. An attacker can cause the host to read local files (e.g., Kubernetes-mounted secrets) into the SAML document. If the attacker is not a trusted SAML SP, signature verification will fail and the document is discarded, but file contents may still be exposed through logs or error messages. This issue affects all versions of esaml, including forks by arekinath, handnot2, and dropbox. Users running on Erlang/OTP 27 or later are not affected due to Xmerl defaulting to entities disabled.
A vulnerability allowing XML External Entity (XXE) attacks has been identified in the esaml SAML library and its forks. This vulnerability allows an attacker to manipulate the system into reading local files and incorporating their contents into SAML documents. Additionally, it could enable Server-Side Request Forgery (SSRF) through crafted SAML messages. The issue arises because esaml parses SAML messages controlled by the attacker using a function that does not disable XML entity expansion, prior to verifying signatures. On Erlang/OTP versions before 27, the Xmerl parser allows entity expansion by default, creating a window for pre-signature XXE attacks. Exploitation can lead to exposure of local file contents, such as Kubernetes-mounted secrets, through the SAML document or potentially via logs or error messages if the document is discarded due to failed signature verification.
Users are advised to upgrade to Erlang/OTP 27 or later, where the Xmerl parser disables entity expansion by default, mitigating this vulnerability without requiring changes to the esaml library.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-28809.html | EEF | PatchThird Party Advisory |
| https://github.com/Jump-App/esaml/commit/bab85efde7c136911402a881ca55173759467a26 | EEF | Patch |
| https://osv.dev/vulnerability/EEF-CVE-2026-28809 | EEF | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-611 | Improper Restriction of XML External Entity Reference | EEF |
Affected Products
| Product | Versions |
|---|---|
| arekinath esaml | <= 1.1 |
CPE
Remediation
| |
| dropbox esaml | All versions |
CPE
Remediation
| |
| handnot2 esaml | <= 4.2.0 |
CPE
Remediation
| |
| jump-app esaml | <= 4.6.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 22, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | CVE Modified | EEF |
| Mar 23, 2026 | New CVE Received | EEF |