CVE-2026-59151: Prowler SAML Auth Bypass Vulnerability

CVE-2026-59151 Overview

CVE-2026-59151 is a critical authentication flaw in Prowler, an open-source cloud security platform. Versions prior to 5.30.3 trust the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token. The Assertion Consumer Service (ACS) finish logic in api/src/backend/api/v1/views.py recalculates the tenant from user.email rather than binding token issuance to the validated SAML configuration. An authenticated attacker operating a controlled SAML Identity Provider (IdP) can complete a valid SAML flow for an attacker-owned domain while asserting an email from a different configured tenant. The result is a SAMLToken and tenant-scoped JWT issued for the wrong tenant, enabling cross-tenant account takeover. The weakness maps to [CWE-287: Improper Authentication].

Critical Impact
An authenticated attacker with a controlled SAML IdP can hijack accounts across tenants, gaining full access to another organization's Prowler workspace.

Affected Products

Prowler cloud security platform, all versions prior to 5.30.3
Prowler API backend component (api/src/backend/api/v1/views.py)
Prowler deployments configured with SAML single sign-on across multiple tenants

Discovery Timeline

2026-07-10 - CVE-2026-59151 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-59151

Vulnerability Analysis

Prowler supports multi-tenant SAML authentication where each tenant maps to one or more email domains through the SAMLDomainIndex model. During the ACS finish step, the application looks up the SAML configuration for the requesting organization but then derives the destination tenant from the email address contained in the SAML assertion. Because the assertion is signed by whichever IdP the attacker controls, the domain in user.email is not cryptographically bound to the tenant that owns it. Any attacker with a legitimate SAML integration for their own tenant can craft assertions containing another tenant's email domain and obtain a valid JWT scoped to that victim tenant.

Root Cause

The root cause is a trust boundary violation between authentication and authorization. The SAML signature validation confirms only that the attacker-controlled IdP issued the response. The tenant selection logic then re-derives the tenant from the untrusted email claim inside that response. The vulnerable code path fetched only the SAMLConfiguration without carrying its bound tenant object forward into the token issuance step.

Attack Vector

Exploitation requires an authenticated attacker who controls a SAML IdP registered with a Prowler tenant. The attacker initiates a SAML login against their own tenant's ACS endpoint but crafts the SAMLResponse so that the NameID or email attribute contains an address belonging to a victim tenant's configured domain. The ACS finish logic validates the signature against the attacker's IdP, then issues a SAMLToken and tenant-scoped JWT for the victim tenant based on the asserted email domain.

python

# Vulnerable pattern (pre-5.30.3) vs. fix in api/src/backend/api/v1/views.py
try:
    check = SAMLDomainIndex.objects.get(email_domain=organization_slug)
    with rls_transaction(str(check.tenant_id)):
-        SAMLConfiguration.objects.get(tenant_id=str(check.tenant_id))
+        saml_config = SAMLConfiguration.objects.select_related("tenant").get(
+            tenant_id=str(check.tenant_id)
+        )
+        tenant = saml_config.tenant
    social_app = SocialApp.objects.get(
        provider="saml", client_id=organization_slug
    )

Source: Prowler commit f5ff30ad175bd2edf02cd28872653c1cda5867b7. The patch binds the tenant object to the validated SAMLConfiguration so token issuance no longer trusts the asserted email domain.

Detection Methods for CVE-2026-59151

Indicators of Compromise

SAML authentication events where the asserting IdP entity ID does not match the tenant associated with the issued JWT.
SAMLToken records tied to users whose email domain differs from the tenant of the SAML configuration used during login.
Unexpected successful logins to a tenant originating from an IdP that was never provisioned for that tenant.

Detection Strategies

Correlate organization_slug used at the ACS endpoint with the tenant ID recorded in the issued JWT and flag mismatches.
Audit application logs for SAML flows where the email_domain of the authenticated user does not equal the email_domain bound to the completing SAMLConfiguration.
Review pull request #11650 and the GHSA-h8m9-jgf8-vwvp advisory to model detection rules around the fixed code path.

Monitoring Recommendations

Alert on the creation of new SAMLConfiguration or SAMLDomainIndex entries and validate that the associated domain is owned by the tenant.
Monitor for repeated ACS requests from the same source IP targeting multiple organization_slug values in a short interval.
Track JWT issuance metrics per tenant and investigate spikes in cross-tenant session activity.

How to Mitigate CVE-2026-59151

Immediate Actions Required

Upgrade Prowler to version 5.30.3 or later without delay.
Rotate all active SAMLToken values and tenant-scoped JWTs issued before the upgrade.
Review historical SAML login events for evidence of cross-tenant token issuance and revoke any suspicious sessions.
Re-verify ownership of every email domain currently registered in SAMLDomainIndex.

Patch Information

The fix is included in Prowler release 5.30.3. The relevant commits are bf3b5c2ba713e533014927141b64948c82c8f32e and f5ff30ad175bd2edf02cd28872653c1cda5867b7. Both bind token issuance to the tenant resolved from the validated SAMLConfiguration instead of the asserted email domain.

Workarounds

If patching is not immediately possible, disable SAML authentication for multi-tenant Prowler deployments and rely on alternative identity providers.
Restrict SAML IdP registration to trusted administrators and require out-of-band verification of any new domain association.
Temporarily enforce that each tenant is limited to a single verified email domain to reduce the domain-claiming attack surface.

bash

# Upgrade Prowler to the patched release
pip install --upgrade "prowler>=5.30.3"

# Verify the installed version
prowler --version