CRITICAL 9.6 GitHub
CVE-2026-59151
Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover
## SAML Tenant Binding Enables Cross-Tenant Account Takeover
### Summary
Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token. A malicious tenant with its own SAML configuration and a self-controlled IdP could complete a valid SAML flow for its own configured domain, while asserting an email address from another configured domain.
In the vulnerable flow, the ACS finish logic later derived the tenant fr
Affected Products
- pip/prowler-cloud < 5.30.3
References
- https://github.com/advisories/GHSA-h8m9-jgf8-vwvp
- https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp
- https://nvd.nist.gov/vuln/detail/CVE-2026-59151
- https://github.com/prowler-cloud/prowler/pull/11650
This critical severity vulnerability with a CVSS score of 9.6 was published on 2026-09-11 via GitHub. Affected: pip/prowler-cloud < 5.30.3.
Risk Timeline
CVE Disclosed2026-09-11 · 6 days ago
Remediation Resources
NVD / MITRE
nvd.nist.gov/vuln/detail/CVE-2026-59151Related Vulnerabilities
| CVE | Title | Severity | CVSS |
|---|---|---|---|
| CVE-2026-63374 | AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate | CRITICAL | — |
vulnfeed aggregates 14649 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.