Improper authentication in crewjam/saml
Priority MEDIUM 50CWE-115Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.
Summary
A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Why it matters now
EPSS 0.04931 92nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial github.com/crewjam/saml (Go): 0.4.3Red Hat: 1 advisoryRed Hat: 2 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | crewjam/saml | grafana-7.3.6, grafana-7.2.3, grafana-6.7.5, github.com/crewjam/saml-0.4.3 | — | No fix listed | CNA |
| — | github.com/crewjam/saml (Go) | before 0.4.3 | 0.4.3 | Patch available | GHSA-4hq8-gmxx-h6w9 |
- crewjam/saml Vendor— Affected grafana-7.3.6, grafana-7.2.3, grafana-6.7.5, github.com/crewjam/saml-0.4.3 Fixed in — No fix listed CNA
- github.com/crewjam/saml (Go) Vendor— Affected before 0.4.3 Fixed in 0.4.3 Patch available GHSA-4hq8-gmxx-h6w9
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:* | before 6.7.5; 7.0.0 to before 7.2.3; 7.3.0 to before 7.3.6 | Vulnerable | Grafana |
| cpe:2.3:a:saml_project:saml:*:*:*:*:*:*:*:* | before 0.4.3 | Vulnerable | crewjam |
| cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* | 3.11 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_service_mesh:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
- cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:* Versions before 6.7.5; 7.0.0 to before 7.2.3; 7.3.0 to before 7.3.6 Vulnerable ·Grafana
- cpe:2.3:a:saml_project:saml:*:*:*:*:*:*:*:* Versions before 0.4.3 Vulnerable ·crewjam
- cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_service_mesh:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
Remediation
- Fix · GHSA-4hq8-gmxx-h6w9 github.com/crewjam/saml (Go) Fixed in 0.4.3 Advisory →
Red Hat 1 advisory
- RHSA-2021:1859 Released 2021-05-18 · Red Hat rating Moderategrafana security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) grafana-7.3.6-2.el8
Vendor assessments
Red Hat
Red Hat rating: Critical. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Service Mesh 1 | Affected | No fix planned: Out of support scope |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:1859 |
| Red Hat OpenShift Container Platform 4.7 | Fixed | RHSA-2020:5633 |
Not affected: 7 products
- Red Hat 3scale API Management Platform 2
- Red Hat Ceph Storage 2
- Red Hat Ceph Storage 3
- Red Hat Ceph Storage 4
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4.7
- Red Hat Storage 3
Timeline
- 2026-10-02 Threatist record created from CVE-2020-27846
- 2026-10-03 Alias added: GHSA-4hq8-gmxx-h6w9
References
Advisory 6
- https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9
- https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise/
- FEDORA-2020-968067abfa
- FEDORA-2020-64e54abd9f
- https://security.netapp.com/advisory/ntap-20210205-0002/
- https://nvd.nist.gov/vuln/detail/CVE-2020-27846
Other 8
- https://github.com/crewjam/saml/commit/da4f1a0612c0a8dd0452cf8b3c7a6518f6b4d053
- https://github.com/crewjam/saml
- https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise
- https://lists.fedoraproject.org/archives/list/[email protected]/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities
- https://pkg.go.dev/vuln/GO-2021-0058
- https://security.netapp.com/advisory/ntap-20210205-0002
Sources
- CVE-2020-27846 · CVE Program
- CVE-2020-27846 · NVD
- FIRST EPSS
- GHSA-4hq8-gmxx-h6w9 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-27846 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences