https://vulnerability.circl.lu/sightings/feed 2026-10-04T14:41:30.840187+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/889d9d4e-920c-410f-901c-ff7fa21b3f2b/export 2026-10-04T14:41:30.862034+00:00 Joseph Lee https://cvepremium.circl.lu/user/syspect {"uuid": "889d9d4e-920c-410f-901c-ff7fa21b3f2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59151", "type": "published-proof-of-concept", "source": "https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp", "content": "", "creation_timestamp": "2026-09-11T22:35:11.676844Z"} 2026-09-11T22:35:11.676844+00:00 https://vulnerability.circl.lu/sighting/2b80778a-0775-4982-aaeb-16c6dcfe39df/export 2026-10-04T14:41:30.864369+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "2b80778a-0775-4982-aaeb-16c6dcfe39df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59151", "type": "seen", "source": "https://gist.github.com/alon710/43186f210d41aaa752fb23f70074de25", "content": "# CVE-2026-59151: CVE-2026-59151: Cross-Tenant Account Takeover via Improper SAML Assertion Validation in Prowler\n\n> **CVSS Score:** 9.6\n> **Published:** 2026-09-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59151\n\n## Summary\nA critical authentication bypass and cross-tenant account takeover vulnerability exists in the Prowler cloud security platform due to improper validation of the SAML Assertion Consumer Service (ACS) flow. An authenticated attacker controlling a custom Identity Provider (IdP) can forge assertions targeting arbitrary user identities across distinct tenants, allowing complete unauthorized access to target tenant-scoped resources.\n\n## TL;DR\nAn architectural flaw in Prowler's SAML validation allows attackers to bypass tenant isolation and take over arbitrary victim accounts by manipulating the asserted NameID value in their own custom IdP.\n\n## Technical Details\n\n- **CWE ID**: CWE-287\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 9.6\n- **EPSS Score**: 0.00322\n- **Impact**: Cross-Tenant Account Takeover\n- **Exploit Status**: None (No active public exploits)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Prowler Cloud Security Platform < 5.30.3\n- Prowler API < 1.31.3\n- **Prowler**: < 5.30.3 (Fixed in: `5.30.3`)\n- **Prowler API**: < 1.31.3 (Fixed in: `1.31.3`)\n\n## Mitigation\n\n- Upgrade Prowler deployment to version 5.30.3 or higher.\n- Audit existing SAML configurations to verify all active domains correspond to verified organization entities.\n- Monitor application container logs for domain mismatch warnings.\n\n**Remediation Steps:**\n1. Identify the running version of the Prowler API container.\n2. Pull the updated Prowler image with tag 5.30.3 or higher, and Prowler API container with tag 1.31.3 or higher.\n3. Restart the application services to apply the patched code paths.\n4. Execute automated tests of the SAML SSO flow to ensure legitimate organization users can authenticate.\n\n## References\n\n- [GitHub Security Advisory GHSA-h8m9-jgf8-vwvp](https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp)\n- [Prowler Pull Request #11650](https://github.com/prowler-cloud/prowler/pull/11650)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59151) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-11T22:32:02.654750Z"} 2026-09-11T22:32:02.654750+00:00 https://vulnerability.circl.lu/sighting/c8c53c8a-ed30-4f59-aee2-83ae1733efcf/export 2026-10-04T14:41:30.865458+00:00 Joseph Lee https://cvepremium.circl.lu/user/syspect {"uuid": "c8c53c8a-ed30-4f59-aee2-83ae1733efcf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59158", "type": "published-proof-of-concept", "source": "https://github.com/thoda-dev/nuxt-ollama/security/advisories/GHSA-fxg7-897c-57mp", "content": "", "creation_timestamp": "2026-09-10T00:35:17.752567Z"} 2026-09-10T00:35:17.752567+00:00 https://vulnerability.circl.lu/sighting/79a19882-a8c8-48f5-a607-102918f86207/export 2026-10-04T14:41:30.865587+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "79a19882-a8c8-48f5-a607-102918f86207", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59151", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqf57z5ovd2k", "content": "\ud83d\udd34 CVE-2026-59151 - Critical (9.6)\n\nProwler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-59151/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-11T17:00:40.341865Z"} 2026-07-11T17:00:40.341865+00:00 https://vulnerability.circl.lu/sighting/c1a6572e-2f88-41b2-8f4e-8009bf54e3d2/export 2026-10-04T14:41:30.865695+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "c1a6572e-2f88-41b2-8f4e-8009bf54e3d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59155", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdpxcsmsv2w", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59155 \u0432 Nezha Monitoring: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/93EB1E2E-2B32-4839-B8DF-C90DAACC95D1", "creation_timestamp": "2026-07-11T03:30:29.343890Z"} 2026-07-11T03:30:29.343890+00:00 https://vulnerability.circl.lu/sighting/549a3f43-8b36-4acc-9f51-089e9624cb75/export 2026-10-04T14:41:30.865793+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "549a3f43-8b36-4acc-9f51-089e9624cb75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59151", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdicopfc32d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59151 \u0432 Prowler: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\n\n\nhttps://kripta.biz/posts/39A03431-B61A-429B-B4D9-F16BB93F17E3", "creation_timestamp": "2026-07-11T01:13:41.332044Z"} 2026-07-11T01:13:41.332044+00:00 https://vulnerability.circl.lu/sighting/1aea8918-c753-4a37-9c5b-541b9fa36a12/export 2026-10-04T14:41:30.865897+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "1aea8918-c753-4a37-9c5b-541b9fa36a12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59155", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqdh3ln4fm2z", "content": "CVE-2026-59155 - Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API\nCVE ID : CVE-2026-59155\n \n Published : July 10, 2026, 10:16 p.m. | 1\u00a0hour, 32\u00a0minutes ago\n \n Description : Nezha Monitoring is a self-hostable, lightweight, servers and website...", "creation_timestamp": "2026-07-11T00:51:49.238650Z"} 2026-07-11T00:51:49.238650+00:00 https://vulnerability.circl.lu/sighting/0dfe2f18-6ffc-41ad-a66d-5bd2b704d0fd/export 2026-10-04T14:41:30.865997+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "0dfe2f18-6ffc-41ad-a66d-5bd2b704d0fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59154", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdbeppzkz2f", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59154 \u0432 Wekan: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/46C360EE-DFD6-466F-A5CE-5350EF654301", "creation_timestamp": "2026-07-10T23:09:32.946124Z"} 2026-07-10T23:09:32.946124+00:00 https://vulnerability.circl.lu/sighting/b2674cbf-2d17-4eaf-8c8b-0fba9020a4d6/export 2026-10-04T14:41:30.866095+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "b2674cbf-2d17-4eaf-8c8b-0fba9020a4d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59151", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqcysjpafd2g", "content": "CVE-2026-59151 - Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover\nCVE ID : CVE-2026-59151\n \n Published : July 10, 2026, 7:17 p.m. | 31\u00a0minutes ago\n \n Description : Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trus...", "creation_timestamp": "2026-07-10T20:36:12.884249Z"} 2026-07-10T20:36:12.884249+00:00 https://vulnerability.circl.lu/sighting/6e1b6ebc-30bb-4232-b959-03f89bc44636/export 2026-10-04T14:41:30.866187+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "6e1b6ebc-30bb-4232-b959-03f89bc44636", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59151", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqcsuscyeq2z", "content": "CVE-2026-59151 - prowler\nProwler's SAML authentication process had a flaw that allowed an attacker to access the wrong tenant's account. This could happen if an attacker controlled a SAML authentication\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#prowler #prowlercloud #CVE #infosec", "creation_timestamp": "2026-07-10T18:50:06.711695Z"} 2026-07-10T18:50:06.711695+00:00