Skip to content
Fencer Vulns
critical 9.8

CVE-2020-27846 json

XML Processing error in github.com/crewjam/saml

published 2020-12-21 5 y ago modified 2026-09-10 1 mo ago also BIT-grafana-2020-27846 , EUVD-2021-1260 , GHSA-4hq8-gmxx-h6w9 , GO-2021-0058

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.9%
EPSS 4.9% chance of exploitation in 30 days, percentile 92%
public exploits
0
none known

Summary

A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Patch / fix

  • go github.com/crewjam/saml 0.4.3
  • bitnami grafana 6.7.5, 7.2.3, 7.3.6
  • grafana grafana 6.7.5, 7.2.3, 7.3.6
  • saml_project saml 0.4.3
  • grafana RHEL 8 7.3.6-2.el8

red hat advisories RHSA-2021:1859

  • grafana Rocky Linux 8 7.3.6-2.el8

rocky linux advisories RLSA-2021:1859

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-27846 updated cvss 9.8

crewjam/saml: authentication bypass in saml authentication

  • Red Hat OpenShift Service Mesh 1 servicemesh-grafana, servicemesh-grafana-prometheus
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Service Mesh 2.0 servicemesh-grafana, servicemesh-grafana-prometheus
    affected: no fix available
  • Red Hat OpenShift Container Platform 3.11 openshift3/grafana
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux AppStream (v. 8) grafana 7.3.6-2.el8
    fixed: vendor fix RHSA-2021:1859
  • Red Hat OpenShift Container Platform 4.7 openshift4/ose-grafana v4.7.0-202102130115.p0
    fixed: vendor fix RHSA-2020:5633
  • Red Hat 3scale API Management Platform 2 3scale-amp2/3scale-rhel7-operator Red Hat Ceph Storage 2 grafana Red Hat Ceph Storage 3 grafana Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat OpenShift Container Platform 4.7 openshift4/ose-cli v4.7.0-202102130115.p0, openshift4/ose-pod v4.7.0-202102130115.p0, openshift4/ose-etcd v4.7.0-202102130115.p0, openshift4/ose-tests v4.7.0-202102181036.p0, openshift4/ose-console v4.7.0-202102130115.p0, openshift4/ose-coredns v4.7.0-202102130115.p0, +129 more
    +1 more products
    Red Hat Storage 3 grafana
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

4.93% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • mattermost.com https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/crewjam/saml
<0.4.3
0.4.3
bitnami grafana
<6.7.5
>=7.0.0, <7.2.3
>=7.3.0, <7.3.6
6.7.5
7.2.3
7.3.6

Affected products

  • n/a crewjam/saml

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.