EUVD-2026-7736
GHSA-ggmg-cqg6-j45g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSetup malicious SAML Identity Provider
-
ExploitRegister second organization on target Sentry instance
-
ExecutionCraft forged SAML assertion
-
ImpactAttacker assumes victim user identity across organizations
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Multi-organization Sentry deployment with SAML SSO enabled (SENTRY_SINGLE_ORGANIZATION setting not True). Attacker requires network access to create second organization or existing access to modify SSO settings in another organization. Affects Sentry versions 21.12.0 through 26.1.0. |
| Impact | CVSS 9.1. Sentry contains application error data including stack traces and user context. |
| Exploit ScenarioDerived | Bypass SAML authentication to access error tracking data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
SAML authentication bypass in Sentry 21.12.0 through 26.1.0.
Earlier versions of this analysis (1)
SAML auth bypass in Sentry error tracking.
RemediationAI
Update Sentry.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-287 SAML validation flaw.
Know when Sentry gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Sentry is a developer-first error tracking and performance monitoring tool. Versions 21.12.0 through 26.1.0 have a critical vulnerability in its SAML SSO implementation which allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. Self-hosted users are only at risk if the following criteria is met: ore than one organizations are configured (SENTRY_SINGLE_ORGANIZATION = True), or malicious user has existing access and permissions to modify SSO settings for another organization in a multo-organization instance. This issue has been fixed in version 26.2.0. To workaround this issue, implement user account-based two-factor authentication to prevent an attacker from being able to complete authentication with a victim's user account. Organization administrators cannot do this on a user's behalf, this requires individual users to ensure 2FA has been enabled for their account.
Executive ViewAI
A critical vulnerability in Sentry (CVSS 9.1) affects organizations using this error tracking platform, potentially enabling attackers to gain unauthorized access or execute malicious code within your monitoring infrastructure. Since no patch is currently available, immediate compensating controls must be implemented to reduce exposure while awaiting vendor remediation.
Restrict network access to Sentry instances via firewall rules and VPN requirements; enforce multi-factor authentication on all accounts; disable or isolate integration points with external systems; implement enhanced logging and SIEM alerting for Sentry access; consider temporary restriction of non-essential Sentry features; establish incident response procedures specific to Sentry compromise; monitor vendor advisory channels weekly for patch status updates.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote code execution in Ivanti Sentry before R10.5.2, R10.6.2, and R10.7.1 allows unauthenticated remote attackers to a
Authentication bypass in Ivanti Sentry before R10.5.2, R10.6.2, and R10.7.1 allows remote unauthenticated attackers to c
A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,
Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitrary co
Sentry is an error tracking and performance monitoring platform. Rated high severity (CVSS 8.1), this vulnerability is r
Telestream Tektronix Medius before 10.7.5 and Sentry before 10.7.5 have a SQL injection vulnerability allowing an unauth
Cross Site Scripting vulnerability in Sentry v.6.0.9 allows a remote attacker to execute arbitrary code via the z parame
An authentication bypass vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,
A vulnerability has been found in Telestream Sentry 6.0.9 and classified as problematic. Rated medium severity (CVSS 5.3
Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute
An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1
Authentication bypass in Ivanti Sentry before R10.6.4, R10.7.3, and R10.8.2 allows a remote unauthenticated attacker to
Exploit-DB