SAML Authentication Bypass in Prowler

Executive Summary

CVE-2026-59151 is a critical security vulnerability in the Prowler cloud security platform involving its SAML authentication flow.

Before version 5.30.3, Prowler trusted the email domain asserted in a SAMLResponse to decide which tenant should receive the authentication token. However, the system recalculated the tenant from the user's email rather than binding token issuance strictly to the validated SAML configuration.

This flaw allowed an authenticated attacker controlling a SAML Identity Provider (IdP) to complete a valid SAML flow for an attacker-controlled domain while asserting an email address from another configured domain. As a result, the system issued a token and tenant-scoped JWT for the wrong tenant, enabling cross-tenant account takeover.

The vulnerability was fixed in Prowler version 5.30.3 by enforcing stricter checks that ensure token issuance is bound to the SAML configuration selected during the Assertion Consumer Service (ACS) route, verifying that the organization slug, SAML configuration email domain, and asserted user email domain all match before issuing a token.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Prowler (CVE-2026-59151) allows an attacker to perform a cross-tenant account takeover by exploiting weaknesses in the SAML authentication flow. This unauthorized access could lead to exposure of sensitive cloud security audit findings, compliance data, and integration secrets belonging to other tenants.

Such unauthorized access and potential data exposure can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls over access to sensitive data and tenant isolation to protect personal and health information.

By enabling attackers to gain full read/write access to victim tenants without proper authorization, the vulnerability undermines the confidentiality and integrity requirements mandated by these regulations, potentially leading to compliance violations.

The fix in version 5.30.3 mitigates this risk by enforcing strict domain and tenant validation during SAML authentication, thereby helping maintain compliance with such standards by preventing unauthorized cross-tenant access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a cross-tenant account takeover, where an attacker gains unauthorized access to another tenant's account within the Prowler platform.

Successful exploitation allows the attacker to obtain a victim's JWT token and switch into their tenant without victim interaction.

Once inside, the attacker gains full read/write access to the victim's cloud security audit findings, compliance data, and integration secrets.

Additionally, the attacker may perform lateral movement into other tenants the victim belongs to, potentially compromising multiple accounts and sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-59151 vulnerability, immediately upgrade Prowler to version 5.30.3 or later, where the issue has been fixed.

• Ensure that the SAML authentication flow only links accounts when the asserted email domain matches the ACS endpoint's tenant domain.
• Verify that users are members of the tenant associated with the asserted email domain before allowing login.
• Reject SAML assertions with mismatched email domains to prevent cross-tenant account takeover.

These steps are implemented in the patched version 5.30.3, which enforces stricter validation of SAML assertions and tenant membership to prevent unauthorized access.

Useful 0 Not Useful 0