Prowler CVE-2026-73264

Exploitation requires an authenticated Prowler user account with permission to create or modify Lighthouse AI provider configurations - corresponding to the PR:H (high privilege) CVSS metric. The attacker must be able to issue POST requests to /api/v1/lighthouse/providers or /api/v1/lighthouse/providers/{id}/connection. The Lighthouse feature itself must be deployed and accessible; deployments that do not use the Lighthouse module or that have not configured any openai_compatible provider are not exposed to the credential-exfiltration path. Non-default conditions that limit exploitation include: the requirement for high-privilege authenticated access (limiting the attack surface to administrators or compromised admin credentials), the presence of the Lighthouse feature in the deployment, and the configuration of at least one openai_compatible LLM provider with an API key. Exploitation is further constrained by any egress firewall rules on the Prowler host that block outbound requests to internal network ranges. There is no unauthenticated attack path and no user-interaction vector.

The CVSS 7.6 score reflects the high real-world impact accurately: although PR:H limits the attack surface to users with Lighthouse configuration access, S:C and C:H together reflect that the SSRF bridges to systems entirely outside Prowler's security boundary and leaks credentials. In practice, even a mid-sized municipal IT team in inowroclaw running Prowler as their primary cloud posture tool should treat this as urgent, because any compromised or malicious admin account can silently exfiltrate the LLM API key and map internal infrastructure. No EPSS data was provided in the input, so exploitation probability cannot be quantified; however, the SSRF path is low-complexity once authenticated, and the fix PR confirms the vulnerability is exploitable via the connection-test endpoint without requiring any background job to fire asynchronously. No CISA KEV listing is present, and no POC code has been identified, suggesting exploitation has not yet been observed at scale. SSVC signals: exploitation status is none/publicly known issue with fix; automatable only after authentication; technical impact is total on confidentiality within scope. The primary risk channel is credential exfiltration (API keys) rather than direct lateral movement, but stolen IMDS tokens in cloud environments could chain into IAM privilege escalation.

An attacker who holds - or has compromised - a Prowler account with Lighthouse configuration permissions submits a POST request to /api/v1/lighthouse/providers with base_url set to an attacker-controlled HTTPS server or an internal cloud metadata endpoint such as http://169.254.169.254/latest/meta-data/iam/security-credentials/. When Prowler's backend calls client.models.list against that URL, the outbound request includes the victim's LLM API key in the Authorization header, which the attacker captures; if directed at cloud IMDS, the response may contain temporary IAM credentials enabling further privilege escalation. No POC code has been publicly identified, but the attack requires only a standard authenticated API call.