Remote code execution in Prowler via kubeconfig auth-provider cmd-path (CVE-2026-73263)

The Prowler Kubernetes provider connection test accepts kubeconfig credentials that use a legacy `gcp` auth-provider with `config.cmd-path` and `config.cmd-args` fields, because the input validator (`kubeconfig_contains_exec_auth`) checks only for `exec` blocks and does not inspect `auth-provider` blocks. When a connection test is triggered, the stored kubeconfig is loaded via `config.load_kube_config_from_dict`, causing the kubernetes-python client to execute the attacker-supplied command through `subprocess.Popen` on the shared multi-tenant Celery worker before any cluster contact occurs. With self-registration enabled by default, an unauthenticated attacker can reach this code path with three API calls, resulting in arbitrary command execution as the `prowler` user (uid 1000) on the shared worker serving all tenants. Affected versions: - < 5.36.0 We recommend updating to: 5.36.0. CVSS 9.9 · our assessment: act_now Reference: https://github.com/prowler-cloud/prowler/security/advisories/GHSA-ccqh-6cjc-wp4j Details: https://vuln.today/cve/CVE-2026-73263