EUVD-2026-57224Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network API reachable with only low-privilege authenticated provider access (PR:L), trivial to trigger (AC:L), and code runs on a shared worker crossing trust boundaries (S:C) with full RCE impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfig_content containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfig_contains_exec_auth in api/src/backend/api/v1/serializers.py checked only exec blocks, and POST /api/v1/providers/{id}/connection loaded it through config.load_kube_config_from_dict in prowler/providers/kubernetes/kubernetes_provider.py, causing kubernetes-python CommandTokenSource.token to run the attacker-supplied command through subprocess.Popen on the shared worker. This issue is fixed in version 5.36.0.
Articles & Coverage 3
AnalysisAI
Authenticated command injection in Prowler (Cloud/API) before 5.36.0 lets a low-privileged user with provider-management access run arbitrary shell commands on the shared backend worker. The Kubernetes provider's connection test accepted a kubeconfig containing a legacy GCP auth-provider with cmd-path/cmd-args, which the kubernetes-python client executed via subprocess when POST /api/v1/providers/{id}/connection loaded it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated account on the Prowler Cloud/API backend with permission to create a Kubernetes provider and invoke the connection test (POST /api/v1/providers/{id}/connection). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9 Critical) is well-supported by the mechanism: network-reachable API, low complexity, only low privileges required (an authenticated Prowler user able to create/test a provider), no user interaction, and a scope change because code executes on a shared worker that may serve other tenants/scans. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged but authenticated Prowler user creates a Kubernetes provider and submits a crafted kubeconfig whose user block uses a legacy gcp auth-provider with config.cmd-path set to /bin/sh (and cmd-args carrying a payload). When they trigger POST /api/v1/providers/{id}/connection, the backend loads the kubeconfig and the kubernetes-python client executes the command on the shared worker, giving the attacker code execution. … |
| Remediation | Upgrade to Prowler 5.36.0 or later, which is the vendor-released patch (Vendor-released patch: 5.36.0); the fix rejects legacy auth-provider.config.cmd-path command authentication in kubeconfig validation (PR https://github.com/prowler-cloud/prowler/pull/12091, commit 0b782fcb8c24ece7bd38deede2b8f13d8583e39c, advisory GHSA-ccqh-6cjc-wp4j). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Prowler instances to identify versions before 5.36.0, review access logs for suspicious provider-management activity, and document which systems have high-privileged user access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today