CVE-2026-73263
Received Received - Intake

Kubernetes Provider Command Injection in Prowler

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfig_content containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfig_contains_exec_auth in api/src/backend/api/v1/serializers.py checked only exec blocks, and POST /api/v1/providers/{id}/connection loaded it through config.load_kube_config_from_dict in prowler/providers/kubernetes/kubernetes_provider.py, causing kubernetes-python CommandTokenSource.token to run the attacker-supplied command through subprocess.Popen on the shared worker. This issue is fixed in version 5.36.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-73263
EUVD
EUVD-2026-57224

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
prowler-cloud prowler 5.36.0
prowler-cloud prowler to 5.36.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73263 is a critical Remote Code Execution (RCE) vulnerability in Prowler versions prior to 5.36.0. It allows attackers to execute arbitrary commands on shared multi-tenant scan workers by exploiting a kubeconfig authentication bypass. The flaw occurs because the API validator only checks for 'exec' blocks in kubeconfig files but misses legacy auth-providers like 'gcp' with cmd-path and cmd-args. When a malicious kubeconfig is saved, the Kubernetes Python client runs the attacker's command via subprocess.Popen during the connection test.

Detection Guidance

Check Prowler version with: docker exec prowler-cloud-prowler-prowler-prowler --version. If version is below 5.36.0, the system is vulnerable. Review Kubernetes kubeconfig files for legacy gcp auth-provider entries with cmd-path or cmd-args. Inspect API logs for connection test failures or unexpected subprocess.Popen calls.

Impact Analysis

An attacker exploiting this vulnerability can gain full control over the shared Celery worker, allowing them to access sensitive environment variables such as encryption keys, JWT signing keys, and cloud provider credentials for all tenants. This could lead to data breaches, unauthorized access to cloud resources, and potential lateral movement within the environment.

Compliance Impact

This vulnerability could lead to severe compliance violations under GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protection of personal data, and a breach could result in significant fines. HIPAA mandates safeguards for protected health information, and this flaw could expose such data, leading to penalties and reputational damage.

Mitigation Strategies

Upgrade Prowler to version 5.36.0 or later immediately. Disable self-registration in Prowler Cloud if enabled. Review and remove any legacy gcp auth-provider configurations from kubeconfig files. Restart all Prowler workers to clear any active malicious sessions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73263. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart