XXE (XML External Entity) in esaml (CVE-2026-28809)
Summary
Vulnerability in esaml (CVE-2026-28809). Risk of unauthorized operations or information disclosure.
Original description
The description as published by the source.
Summary
XML External Entity (XXE) vulnerability in esaml (and its forks) allows an attacker to cause the system to read local files and incorporate their contents into processed SAML documents, and potentially perform SSRF via crafted SAML messages.
esaml parses attacker-controlled SAML messages using xmerl_scan:string/2 before signature verification without disabling XML entity expansion. On Erlang/OTP versions before 27, Xmerl allows entities by default, enabling pre-signature XXE attacks. An attacker can cause the host to read local files (e.g., Kubernetes-mounted secrets) into the SAML document. If the attacker is not a trusted SAML SP, signature verification will fail and the document is discarded, but file contents may still be exposed through logs or error messages.
This issue affects all versions of esaml, including forks by arekinath, handnot2, and dropbox. Users running on Erlang/OTP 27 or later are not affected due to Xmerl defaulting to entities disabled.
Workarounds
Upgrade to Erlang/OTP 27 or later. Starting with OTP 27, xmerl_scan disables entity expansion by default, which mitigates this vulnerability without changes to esaml.
Configurations
The application must use esaml to process SAML messages and run on Erlang/OTP versions before 27. Starting with OTP 27, xmerl_scan disables entity expansion by default, which mitigates this vulnerability.
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-28809 has been found in esaml.
Risk of unauthorized operations or information disclosure. CVSS score: 5.3/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "esaml CVE-2026-28809" on the vendor's site.
CVE-2026-28809 (esaml) — CWE-611 / CVSS v3 5.3
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Workaround: Upgrade to Erlang/OTP 27 or later.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-611) exists in esaml.
Check the vendor advisory for the affected versions of esaml.
Severity: Medium (CVSS 5.3/10). Risk of unauthorized operations or information disclosure.
Update to the patched release per vendor advisory.
Workaround: Upgrade to Erlang/OTP 27 or later.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'esaml' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'esaml' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
esamlを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply temporary workaround mitigate
Upgrade to Erlang/OTP 27 or later.パッチが適用されるまでの応急処置として、Upgrade to Erlang/OTP 27 or later. を実施。回避策の副作用 (機能低下) を確認した上で。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory osv.dev
- package hex.pm
- patch github.com
- web cna.erlef.org