CVE-2026-73264
Received Received - Intake

Authenticated SSRF in Prowler Cloud Security Platform

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated base_url for the openai_compatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/{id}/connection, causing api/src/backend/tasks/jobs/lighthouse_providers.py to send outbound requests, including the API key in the Authorization header, to attacker-controlled or internal endpoints when client.models.list was called. This issue is fixed in version 5.33.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-73264
EUVD
EUVD-2026-57225

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
prowler-cloud prowler to 5.33.1 (inc)
prowler-cloud prowler to 5.33.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Prowler's API affecting versions 5.33.0 and earlier. An authenticated attacker can exploit it by configuring a provider with the openai_compatible type and supplying a malicious base_url parameter. This causes the Prowler backend to send outbound HTTP requests to attacker-controlled or internal network endpoints, potentially exposing sensitive API credentials in the Authorization header.

Detection Guidance

Check Prowler logs for suspicious outbound requests to unrecognized base_url endpoints. Review API calls to POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/{id}/connection for unauthorized base_url modifications. Inspect network traffic for unexpected connections to internal or external endpoints from Prowler processes.

Impact Analysis

The vulnerability allows credential theft, internal network reconnaissance, and cloud metadata exposure. Attackers could steal API keys, map internal networks, or access sensitive cloud provider metadata.

Mitigation Strategies

Update Prowler to version 5.33.1 or later to address the SSRF vulnerability. Restrict access to Lighthouse provider configuration to authorized users only. Monitor API logs for unauthorized provider modifications and outbound requests to untrusted endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73264. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart