CVE-2026-28809: esaml SAML Library XXE Vulnerability Leading to Local File Read and SSRF
Summary
CVE-2026-28809: XXE in esaml SAML library allows local file read and potential SSRF. Affects esaml versions 3.0.1 – 4.6.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
esaml is a SAML library designed for use with Erlang applications, facilitating secure authentication and authorization through SAML assertions. It is widely utilized in various applications that require identity federation. However, the library has a critical vulnerability that allows attackers to exploit XML External Entities (XXE), potentially leading to unauthorized access to local files and server-side request forgery (SSRF).
Vulnerability Detail
The vulnerability arises from the way esaml parses SAML messages using the xmerl_scan:string/2 function without disabling XML entity expansion. This oversight allows attackers to craft malicious SAML messages that can read local files on the server, such as sensitive Kubernetes secrets. Although signature verification may fail for untrusted SAML service providers (SPs), the contents of local files can still be exposed through logs or error messages, posing a significant security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider disabling XML entity expansion in your application. For example, you can modify the parsing function to explicitly disable entities. However, this is a temporary measure and upgrading is strongly recommended.
Conclusion
The XXE vulnerability in the esaml SAML library poses significant risks, including local file read and SSRF attacks. Users are strongly encouraged to update to the latest version of the library and ensure they are using Erlang/OTP 27 or later to mitigate these risks. Regular monitoring with tools like Vulert can help maintain security against such vulnerabilities.
See every vulnerability recorded for esaml →
FAQ
XXE vulnerabilities occur when an XML parser processes external entities, allowing attackers to read local files or perform SSRF attacks.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The consequences include unauthorized access to sensitive local files and potential SSRF attacks, which can lead to further exploitation of the server.
Yes, users should upgrade to the latest version of esaml that addresses the XXE vulnerability, especially if they are using Erlang/OTP version 27 or later.
If you cannot upgrade, implement workarounds such as disabling XML entity expansion in your parsing logic, but plan to upgrade as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for esaml.
