CVE-2026-100169
2 advisories.
PyPI/prowler-cloud CVE-2026-100169, CVE-2026-59151: critical 9.6
Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover
Action: Upgrade prowler-cloud to 5.30.3 or later.
pip install prowler-cloud==5.30.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.30.3 | - |
Fixed versions
| 5.30.3 |
Sources
- osv: GHSA-h8m9-jgf8-vwvp
- https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp
- https://nvd.nist.gov/vuln/detail/CVE-2026-59151
- https://github.com/prowler-cloud/prowler/pull/11650
- https://github.com/prowler-cloud/prowler/commit/bf3b5c2ba713e533014927141b64948c82c8f32e
- https://github.com/prowler-cloud/prowler/commit/f5ff30ad175bd2edf02cd28872653c1cda5867b7
- https://github.com/prowler-cloud/prowler
- https://github.com/prowler-cloud/prowler/releases/tag/5.30.3
- https://github.com/pypa/advisory-database/tree/main/vulns/prowler-cloud/PYSEC-2026-3725.yaml
CVE-2026-100169, CVE-2026-59151 · published · modified · JSON
PyPI/prowler-cloud CVE-2026-100169, CVE-2026-59151: critical 9.6
Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token,
Action: Upgrade prowler-cloud to 5.30.3 or later.
pip install prowler-cloud==5.30.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.30.3 | - |
Fixed versions
| 5.30.3 |
Sources
- osv: PYSEC-2026-3725
- https://github.com/prowler-cloud/prowler/releases/tag/5.30.3
- https://github.com/prowler-cloud/prowler/pull/11650
- https://github.com/prowler-cloud/prowler/commit/bf3b5c2ba713e533014927141b64948c82c8f32e
- https://github.com/prowler-cloud/prowler/commit/f5ff30ad175bd2edf02cd28872653c1cda5867b7
- https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp
CVE-2026-100169, CVE-2026-59151 · published · modified · JSON