Security readout for executives and security teams
Plain-English summary
Applications using esaml on Erlang/OTP before version 27 may process malicious SAML XML before checking its signature. An unauthenticated attacker could make the server read local files, potentially exposing secrets through logs or errors, and may trigger server-side requests.
Executive priority
Prioritize identification within normal vulnerability-response timelines, accelerating internet-facing identity services and workloads containing accessible secrets. Immediate emergency treatment is not supported by the supplied evidence, but affected pre-27 deployments should not wait for proof of exploitation because attacks can occur before authentication.
Technical view
esaml and identified forks call xmerl_scan:string/2 on attacker-controlled SAML before signature verification. Before Erlang/OTP 27, Xmerl permits entity expansion by default, enabling pre-authentication XXE. Consequences include local file inclusion and potential SSRF. Invalid signatures may stop later processing but do not prevent the initial XML parsing.
Likely exposure
Exposure requires an application using esaml or a named fork, running Erlang/OTP before 27, and accepting attacker-controlled SAML messages. Internet-accessible SAML endpoints and workloads holding mounted secrets are higher priority. The supplied sources do not provide precise affected release boundaries.
Exploitation context
The CVSS 4.0 score is 6.3. No privileges or user interaction are required, although the vector records a subsequent condition. The source bundle provides no evidence of active exploitation, and the CVE is not listed as KEV. Potential disclosure may depend on logs, errors, or downstream document handling.
Researcher notes
Affected release boundaries are incomplete: the bundle says all esaml versions and forks are affected but supplies no conventional fixed version. It also lists Jump-App commit identifiers while identifying one as a patch reference. Validate exact repository provenance and deployed commit state. Do not infer that signature rejection eliminates exposure because entity processing occurs first.
Mitigation direction
- Upgrade affected deployments to Erlang/OTP 27 or later, which disables Xmerl entities by default.
- Review and apply applicable esaml vendor patches, including the referenced Jump-App patch, after compatibility testing.
- Restrict unnecessary outbound connectivity from SAML-processing services to reduce potential SSRF impact.
- Prevent SAML parsing errors and document contents from exposing secrets through user-visible responses or logs.
- Check current guidance from the maintained fork or application vendor for supported remediation.
Validation and detection
- Inventory applications and transitive dependencies for esaml and the arekinath, handnot2, Dropbox, or Jump-App forks.
- Record the Erlang/OTP runtime version for every service that processes SAML messages.
- Confirm affected services run Erlang/OTP 27 or later, or contain the applicable vendor patch.
- Review dependency locks and deployed artifacts rather than relying only on repository manifests.
- Inspect logs and error handling for accidental inclusion of parsed SAML content or local file data.
- Review outbound telemetry from SAML services for unexpected requests associated with XML processing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-611: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCloud metadata behavior lookup
The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-28809 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N——EEFVulnerability scoring details
Base CVSS 4.0 score
6.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://cna.erlef.org/cves/CVE-2026-28809.htmlCVE reference, EEF · third-party-advisory, related
- https://osv.dev/vulnerability/EEF-CVE-2026-28809CVE reference, EEF · related
- https://github.com/Jump-App/esaml/commit/bab85efde7c136911402a881ca55173759467a26CVE reference, EEF · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.