Prowler-cloud vulnerabilities
We track 3 vulnerabilities in Prowler-cloud products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 12, 2026.
Latest Prowler-cloud vulnerabilities
- 7.6 High severity
prowler: Server-Side Request Forgery
Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated base_url for the openai_compatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighth
- 9.9 Critical severity
prowler: Improper Neutralization of Special Elements used in an OS Command
Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfig_content containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfig_contains_exec_auth in api/src/backend/a
- 9.6 Critical severity
prowler: Improper Authentication
Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py