{"vulnerability": "CVE-2026-5915", "sightings": [{"uuid": "351d5028-1a03-427a-89f2-bd13c7a1aaed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5915", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260409", "content": "", "creation_timestamp": "2026-04-08T18:00:00.000000Z"}, {"uuid": "3631ba68-c1d5-47a1-94cb-9f55266a422a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5915", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mj3eq5s3te2j", "content": "", "creation_timestamp": "2026-04-09T17:51:58.935619Z"}, {"uuid": "c1ed0f3d-bcd4-4f97-982c-d3dcd8d17a30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5915", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260413", "content": "", "creation_timestamp": "2026-04-12T20:00:00.000000Z"}, {"uuid": "12c5d215-b7ad-48cb-83f8-5ebde131cd09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5915", "type": "seen", "source": "https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review", "content": "", "creation_timestamp": "2026-04-14T15:49:19.000000Z"}, {"uuid": "44cbb097-fc83-44f7-802b-696ef2e360a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5915", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/chromeos-multiple-vulnerabilities_20260428", "content": "", "creation_timestamp": "2026-04-27T20:00:00.000000Z"}, {"uuid": "241a9505-621c-4e9a-b145-704a47182787", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59152", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpyj6ybouc2b", "content": "CVE-2026-59152 - Arbitrary server-side file read in LangSmith SDK TracingMiddleware\nCVE ID : CVE-2026-59152\n \n Published : July 6, 2026, 2:26 p.m. | 1\u00a0hour, 21\u00a0minutes ago\n \n Description : LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior t...", "creation_timestamp": "2026-07-06T16:30:13.714433Z"}, {"uuid": "6e1b6ebc-30bb-4232-b959-03f89bc44636", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59151", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqcsuscyeq2z", "content": "CVE-2026-59151 - prowler\nProwler's SAML authentication process had a flaw that allowed an attacker to access the wrong tenant's account. This could happen if an attacker controlled a SAML authentication\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#prowler #prowlercloud #CVE #infosec", "creation_timestamp": "2026-07-10T18:50:06.711695Z"}, {"uuid": "b2674cbf-2d17-4eaf-8c8b-0fba9020a4d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59151", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqcysjpafd2g", "content": "CVE-2026-59151 - Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover\nCVE ID : CVE-2026-59151\n \n Published : July 10, 2026, 7:17 p.m. | 31\u00a0minutes ago\n \n Description : Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trus...", "creation_timestamp": "2026-07-10T20:36:12.884249Z"}, {"uuid": "0dfe2f18-6ffc-41ad-a66d-5bd2b704d0fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59154", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdbeppzkz2f", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59154 \u0432 Wekan: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/46C360EE-DFD6-466F-A5CE-5350EF654301", "creation_timestamp": "2026-07-10T23:09:32.946124Z"}, {"uuid": "1aea8918-c753-4a37-9c5b-541b9fa36a12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59155", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqdh3ln4fm2z", "content": "CVE-2026-59155 - Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API\nCVE ID : CVE-2026-59155\n \n Published : July 10, 2026, 10:16 p.m. | 1\u00a0hour, 32\u00a0minutes ago\n \n Description : Nezha Monitoring is a self-hostable, lightweight, servers and website...", "creation_timestamp": "2026-07-11T00:51:49.238650Z"}, {"uuid": "549a3f43-8b36-4acc-9f51-089e9624cb75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59151", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdicopfc32d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59151 \u0432 Prowler: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\n\n\nhttps://kripta.biz/posts/39A03431-B61A-429B-B4D9-F16BB93F17E3", "creation_timestamp": "2026-07-11T01:13:41.332044Z"}, {"uuid": "c1a6572e-2f88-41b2-8f4e-8009bf54e3d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59155", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdpxcsmsv2w", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59155 \u0432 Nezha Monitoring: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/93EB1E2E-2B32-4839-B8DF-C90DAACC95D1", "creation_timestamp": "2026-07-11T03:30:29.343890Z"}, {"uuid": "79a19882-a8c8-48f5-a607-102918f86207", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59151", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqf57z5ovd2k", "content": "\ud83d\udd34 CVE-2026-59151 - Critical (9.6)\n\nProwler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-59151/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-11T17:00:40.341865Z"}, {"uuid": "c8c53c8a-ed30-4f59-aee2-83ae1733efcf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59158", "type": "published-proof-of-concept", "source": "https://github.com/thoda-dev/nuxt-ollama/security/advisories/GHSA-fxg7-897c-57mp", "content": "", "creation_timestamp": "2026-09-10T00:35:17.752567Z"}, {"uuid": "2b80778a-0775-4982-aaeb-16c6dcfe39df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59151", "type": "seen", "source": "https://gist.github.com/alon710/43186f210d41aaa752fb23f70074de25", "content": "# CVE-2026-59151: CVE-2026-59151: Cross-Tenant Account Takeover via Improper SAML Assertion Validation in Prowler\n\n> **CVSS Score:** 9.6\n> **Published:** 2026-09-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59151\n\n## Summary\nA critical authentication bypass and cross-tenant account takeover vulnerability exists in the Prowler cloud security platform due to improper validation of the SAML Assertion Consumer Service (ACS) flow. An authenticated attacker controlling a custom Identity Provider (IdP) can forge assertions targeting arbitrary user identities across distinct tenants, allowing complete unauthorized access to target tenant-scoped resources.\n\n## TL;DR\nAn architectural flaw in Prowler's SAML validation allows attackers to bypass tenant isolation and take over arbitrary victim accounts by manipulating the asserted NameID value in their own custom IdP.\n\n## Technical Details\n\n- **CWE ID**: CWE-287\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 9.6\n- **EPSS Score**: 0.00322\n- **Impact**: Cross-Tenant Account Takeover\n- **Exploit Status**: None (No active public exploits)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Prowler Cloud Security Platform < 5.30.3\n- Prowler API < 1.31.3\n- **Prowler**: < 5.30.3 (Fixed in: `5.30.3`)\n- **Prowler API**: < 1.31.3 (Fixed in: `1.31.3`)\n\n## Mitigation\n\n- Upgrade Prowler deployment to version 5.30.3 or higher.\n- Audit existing SAML configurations to verify all active domains correspond to verified organization entities.\n- Monitor application container logs for domain mismatch warnings.\n\n**Remediation Steps:**\n1. Identify the running version of the Prowler API container.\n2. Pull the updated Prowler image with tag 5.30.3 or higher, and Prowler API container with tag 1.31.3 or higher.\n3. Restart the application services to apply the patched code paths.\n4. Execute automated tests of the SAML SSO flow to ensure legitimate organization users can authenticate.\n\n## References\n\n- [GitHub Security Advisory GHSA-h8m9-jgf8-vwvp](https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp)\n- [Prowler Pull Request #11650](https://github.com/prowler-cloud/prowler/pull/11650)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59151) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-11T22:32:02.654750Z"}, {"uuid": "889d9d4e-920c-410f-901c-ff7fa21b3f2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59151", "type": "published-proof-of-concept", "source": "https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp", "content": "", "creation_timestamp": "2026-09-11T22:35:11.676844Z"}]}