EUVD-2026-57225Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
PR:H confirmed by requirement for Lighthouse configuration privileges; S:C and C:H reflect API key exfiltration reaching systems outside Prowler's security boundary; I:L for possible SSRF-induced internal write side-effects.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated base_url for the openai_compatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/{id}/connection, causing api/src/backend/tasks/jobs/lighthouse_providers.py to send outbound requests, including the API key in the Authorization header, to attacker-controlled or internal endpoints when client.models.list was called. This issue is fixed in version 5.33.1.
AnalysisAI
Server-side request forgery in Prowler's Lighthouse AI provider configuration allows an authenticated high-privilege user to redirect outbound HTTP requests - including the configured API key in the Authorization header - to attacker-controlled or internal network endpoints. Affected are all Prowler deployments prior to version 5.33.1 where the Lighthouse feature and an openai_compatible provider type are in use. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Prowler user account with permission to create or modify Lighthouse AI provider configurations - corresponding to the PR:H (high privilege) CVSS metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.6 score reflects the high real-world impact accurately: although PR:H limits the attack surface to users with Lighthouse configuration access, S:C and C:H together reflect that the SSRF bridges to systems entirely outside Prowler's security boundary and leaks credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds - or has compromised - a Prowler account with Lighthouse configuration permissions submits a POST request to /api/v1/lighthouse/providers with base_url set to an attacker-controlled HTTPS server or an internal cloud metadata endpoint such as http://169.254.169.254/latest/meta-data/iam/security-credentials/. When Prowler's backend calls client.models.list against that URL, the outbound request includes the victim's LLM API key in the Authorization header, which the attacker captures; if directed at cloud IMDS, the response may contain temporary IAM credentials enabling further privilege escalation. … |
| Remediation | Upgrade Prowler to version 5.33.1 or later, which introduces server-side URL validation for Lighthouse openai_compatible provider base URLs, rejecting HTTP (non-TLS) schemes, invalid port numbers, loopback addresses, RFC-1918 private IP literals, link-local IMDS addresses (169.254.254.254), IPv6-embedded non-global addresses, and hostnames that resolve post-DNS-lookup to any of the above. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all user accounts with Lighthouse configuration permissions and verify whether the openai_compatible provider is enabled in any deployment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authenticated command injection in Prowler (Cloud/API) before 5.36.0 lets a low-privileged user with provider-management
Cross-tenant account takeover in Prowler (cloud security platform) before 5.30.3 lets an authenticated attacker who oper
Stored cross-site scripting in Prowler's HTML report formatter (all versions prior to 5.37.0) allows any cloud principal
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today