PatchTheCVECVE-2020-27846: A signature verification vulnerability exists in crewjam/saml
72
This week
CRITICAL 9.8REMOTEWATCHLISTUPGRADEUPGRADEDOWNGRADE
CVE-2020-27846 is a critical-severity flaw (CVSS 9.8) affecting grafana, saml, openshift container platform. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Why this priority
- Critical severity
- EPSS top 8%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 4.9% (top 8%) |
| CISA exploited list | No |
| Weakness | CWE-115 |
| Published | 2020-12-21 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
grafana grafana UPGRADE
Affected: < 6.7.5 · >= 7.0.0 and < 7.2.3 · >= 7.3.0 and < 7.3.6
Fixed in: 6.7.5, 7.2.3, 7.3.6
Safe to downgrade to: a release before 7.0.0
1. Check installed version
apt-cache policy grafana || rpm -q grafana || grafana --version
2. UPGRADE to 6.7.5 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade grafana
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade grafana
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 7.0.0 (Debian / Ubuntu)
apt-cache madison grafana
sudo apt install grafana=<VERSION_BEFORE_7.0.0>
sudo apt-mark hold grafana
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list grafana
sudo dnf downgrade grafana-<VERSION_BEFORE_7.0.0>
sudo dnf versionlock add grafana
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
saml project saml UPGRADE
Affected: < 0.4.3
Fixed in: 0.4.3
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy saml || rpm -q saml || saml --version
2. UPGRADE to 0.4.3 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade saml
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade saml
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
redhat openshift container platform DOWNGRADE
Affected: 3.11 · 4.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.11
1. Check installed version
apt-cache policy openshift-container-platform || rpm -q openshift-container-platform || openshift-container-platform --version
2. No fixed release: DOWNGRADE to a release before 3.11 (Debian / Ubuntu)
apt-cache madison openshift-container-platform
sudo apt install openshift-container-platform=<VERSION_BEFORE_3.11>
sudo apt-mark hold openshift-container-platform
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list openshift-container-platform
sudo dnf downgrade openshift-container-platform-<VERSION_BEFORE_3.11>
sudo dnf versionlock add openshift-container-platform
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat openshift service mesh DOWNGRADE
Affected: 2.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.0
1. Check installed version
apt-cache policy openshift-service-mesh || rpm -q openshift-service-mesh || openshift-service-mesh --version
2. No fixed release: DOWNGRADE to a release before 2.0 (Debian / Ubuntu)
apt-cache madison openshift-service-mesh
sudo apt install openshift-service-mesh=<VERSION_BEFORE_2.0>
sudo apt-mark hold openshift-service-mesh
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list openshift-service-mesh
sudo dnf downgrade openshift-service-mesh-<VERSION_BEFORE_2.0>
sudo dnf versionlock add openshift-service-mesh
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat enterprise linux MITIGATE
Affected: 8.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.0
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
fedoraproject fedora MITIGATE
Affected: 32 · 33
Fixed in: no fixed release known
Safe to downgrade to: a release before 32
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
Exact fixes by distribution
A distro patch exists: prefer upgrading over downgrading.
Go · github.com/crewjam/saml · FIXED · 0.4.3 · vulnerable: < 0.4.3 · source
go get github.com/crewjam/saml@v0.4.3
go list -m github.com/crewjam/saml
Fedora 46 · keepalived · FIXED · 2.4.3-1.fc46 · FEDORA-2026-0c83a077d7 · source
sudo dnf upgrade --advisory=FEDORA-2026-0c83a077d7
Fedora ELN · dracut · FIXED · 111-5.eln159 · FEDORA-2026-982407d9e3 · source
sudo dnf upgrade --advisory=FEDORA-2026-982407d9e3
RHEL 8 · grafana · FIXED · grafana-7.3.6-2.el8
sudo dnf upgrade --advisory=RHSA-2021:1859
rpm -q grafana
RHEL 9 · grafana · NOT AFFECTED
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Write-up: grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-27846?
grafana: upgrade to 6.7.5, 7.2.3, 7.3.6; saml: upgrade to 0.4.3; openshift container platform: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2020-27846 being exploited?
CVE-2020-27846 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-27846 affect?
CVE-2020-27846 affects grafana, saml, openshift container platform. Severity is critical (CVSS 9.8). A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
How urgent is CVE-2020-27846?
Priority 72/100. Critical severity; EPSS top 8%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action; On your watchlist
Software pages
Grafana vulnerabilities · Red Hat OpenShift vulnerabilities
Related CVEs
- CVE-2026-21727 LOW 3.3 UPGRADE A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlatio
- CVE-2026-33376 HIGH 7.4 UPGRADE When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses
- CVE-2026-33380 MEDIUM 6.3 UPGRADE A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana s
- CVE-2026-28376 MEDIUM 6.5 UPGRADE The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or str
- CVE-2026-28383 MEDIUM 6.5 UPGRADE A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire