XML External Entity Vulnerability in esaml Affects Multiple Forks by Various Vendors

CVE-2026-28809

What is CVE-2026-28809?

The esaml library is susceptible to an XML External Entity (XXE) vulnerability that allows an attacker to manipulate SAML messages to read local files and expose sensitive data. By leveraging the xmerl_scan:string/2 parsing method before signature verification, an attacker can launch pre-signature XXE attacks, especially on versions of Erlang/OTP prior to 27, where XML entity expansion is enabled by default. This can lead to unauthorized access to local files such as Kubernetes-mounted secrets, which may be logged or shown in error messages even if the SAML signature fails. Users on Erlang/OTP 27 or later are not vulnerable due to the default settings disabling entity expansion.

References