The vulnerability CVE-2026-28809 affects the esaml library used for SAML processing, including forks by Dropbox and others. It is caused by improper restriction of XML External Entity references (CWE-611) due to esaml parsing SAML messages with xmerl_scan:string/2 without disabling XML entity expansion before signature verification. On Erlang/OTP versions before 27, the xmerl XML parser allows entity expansion by default, enabling attackers to craft malicious SAML messages that cause the system to read local files and embed their contents into the SAML document. Although signature verification prevents acceptance of messages from untrusted sources, sensitive file contents may be exposed via logs or error messages. Erlang/OTP 27 and later versions mitigate this by disabling entity expansion by default, preventing exploitation. The CVSS 4.0 base score is 6.3 (medium severity). There is no vendor advisory or patch information provided, and no known exploits have been observed.

An attacker can exploit this vulnerability to cause the esaml library to read local files on the host system and include their contents in processed SAML documents. This can lead to exposure of sensitive information such as Kubernetes-mounted secrets through logs or error messages. The vulnerability does not allow bypassing signature verification, so untrusted SAML messages are discarded, limiting the impact to information disclosure rather than direct authentication bypass or code execution. Systems running Erlang/OTP 27 or later are not affected due to changes in default XML entity handling.

No official patch or vendor advisory is provided for this vulnerability. Users should upgrade to Erlang/OTP version 27 or later, where the xmerl XML parser disables entity expansion by default, effectively mitigating this issue. Alternatively, users should ensure that XML entity expansion is explicitly disabled when parsing SAML messages with esaml. Monitor vendor channels for any future patches or official guidance. Since this is a library vulnerability, users should review their usage of esaml and consider applying custom mitigations if upgrading Erlang/OTP is not immediately feasible.