What is the CVSS score of CVE-2026-59151?

CVE-2026-59151 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Prowler are affected by CVE-2026-59151?

Prowler cloud security platform versions before 5.30.3 contain a critical cross-tenant account takeover vulnerability that allows authenticated attackers operating a SAML identity provider to obtain…. A patch is available.

Is there a public PoC exploit available for CVE-2026-59151?

Yes, a public proof-of-concept exploit is available for CVE-2026-59151. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-59151?

24 hours: Audit your Prowler deployment version and verify you are not running versions prior to 5.30.3. 7 days: Implement compensating controls (disable SAML federation if business-critical is not required, or apply SAML IdP whitelisting and enforce strict email domain validation). 30 days: Prioritize continuous monitoring of Prowler vendor advisories and patch release tracking; upgrade to version 5.30.3 or later immediately upon availability.

Prowler CVE-2026-59151

EUVD-2026-42968 CRITICAL

Improper Authentication (CWE-287)

2026-07-10 GitHub_M

GHSA-h8m9-jgf8-vwvp PYSEC-2026-3725

Authentication Bypass Prowler Prowler Cloud

9.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

9.6 CRITICAL

Remote, low-complexity abuse needing an authenticated attacker-controlled IdP (PR:L); tenant boundary crossed (S:C) yielding victim-tenant account takeover (C:H/I:H), no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 10, 2026 - 19:01 EUVD

Analysis Generated

Jul 10, 2026 - 18:53 vuln.today

DescriptionCVE.org

Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration. An authenticated attacker with a controlled SAML IdP could complete a valid SAML flow for an attacker-controlled domain while asserting an email address from another configured domain, causing a SAMLToken and tenant-scoped JWT to be issued for the wrong tenant and enabling cross-tenant account takeover. This issue is fixed in version 5.30.3.

AnalysisAI

Cross-tenant account takeover in Prowler (cloud security platform) before 5.30.3 lets an authenticated attacker who operates a controlled SAML IdP obtain a tenant-scoped JWT for a victim tenant. The ACS finish logic in api/src/backend/api/v1/views.py derived the destination tenant from the user-asserted email domain rather than binding token issuance to the validated SAML configuration, so an attacker completing a legitimate SAML flow for their own domain while asserting a victim-domain email address receives a SAMLToken and JWT for the wrong tenant. Rated CVSS 9.6 (scope-changing); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Prowler is a multi-tenant cloud security posture management platform whose API (Django/DRF, api/src/backend) supports SAML single sign-on for enterprise login. In a correct SAML SP implementation, the Assertion Consumer Service (ACS) must bind the authenticated session to the specific IdP/SAML configuration that was validated, since the IdP is the trust anchor for a given domain. Here the flaw is CWE-287 (Improper Authentication): the ACS finish routine recalculated the target tenant from user.email (the attacker-controllable Subject/NameID assertion) instead of from the SAML configuration that was actually verified. Because tenant selection was driven by an asserted string rather than the cryptographically validated IdP binding, any domain an attacker's IdP could assert became a routing key for token issuance. The single affected component is cpe:2.3:a:prowler-cloud:prowler, tagged as an Authentication Bypass.

RemediationAI

Upgrade to Prowler 5.30.3, which binds token issuance to the validated SAML configuration rather than recalculating the tenant from user.email; this is a vendor-released patch and the definitive fix (see the release at https://github.com/prowler-cloud/prowler/releases/tag/5.30.3, advisory GHSA-h8m9-jgf8-vwvp at https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp, PR https://github.com/prowler-cloud/prowler/pull/11650, and commits bf3b5c2ba713e533014927141b64948c82c8f32e and f5ff30ad175bd2edf02cd28872653c1cda5867b7). If you cannot upgrade immediately, reduce exposure by restricting which SAML IdPs/domains can be onboarded - avoid self-service or untrusted external SAML tenant configuration, review existing SAML domain-to-tenant mappings for unexpected or attacker-controllable domains, and, where feasible, temporarily disable SAML SSO in favor of local/other authentication until patched; the trade-off is disrupted SSO login for legitimate enterprise users and added onboarding friction. Audit recent SAML logins and issued tokens for tokens scoped to tenants that do not match the authenticating IdP's domain as a detection measure.