CVE-2026-73263: Prowler Kubernetes Provider RCE Vulnerability

CVE-2026-73263 Overview

Prowler is an open-source cloud security platform used to run assessments across AWS, Azure, GCP, and Kubernetes environments. CVE-2026-73263 is a command injection vulnerability [CWE-78] in the Prowler API's Kubernetes provider connection test. Versions prior to 5.36.0 accept kubeconfig_content values containing a legacy GCP auth-provider block with config.cmd-path and config.cmd-args. When the connection test loads the kubeconfig, the Kubernetes Python client executes the attacker-supplied command through subprocess.Popen on the shared worker process. The issue is fixed in Prowler 5.36.0.

Critical Impact
Authenticated users can achieve remote command execution on the Prowler worker by submitting a crafted kubeconfig to the provider connection endpoint.

Affected Products

Prowler versions prior to 5.36.0
Prowler Cloud deployments using the API Kubernetes provider
Self-hosted Prowler API workers accepting kubeconfig submissions

Discovery Timeline

2026-08-12 - CVE-2026-73263 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73263

Vulnerability Analysis

The vulnerability resides in the Prowler API endpoint POST /api/v1/providers/{id}/connection, which validates and loads user-supplied Kubernetes credentials. The serializer function kubeconfig_contains_exec_auth in api/src/backend/api/v1/serializers.py inspected only the modern exec authentication blocks. It ignored legacy auth-provider entries that still support command-based token retrieval.

When the endpoint calls config.load_kube_config_from_dict in prowler/providers/kubernetes/kubernetes_provider.py, the Kubernetes Python client instantiates a CommandTokenSource. That class invokes CommandTokenSource.token, which spawns the configured binary through subprocess.Popen. Because the kubeconfig originates from an authenticated API request, an attacker controls both the command path and its arguments.

Root Cause

The root cause is incomplete input validation. The validator enforced a deny-list on exec credential providers but failed to cover the legacy auth-provider structure. Both mechanisms ultimately execute an external process during connection setup, so partial filtering left an equivalent execution path exposed.

Attack Vector

An authenticated tenant user submits a kubeconfig containing a gcp auth-provider with cmd-path set to an arbitrary binary and cmd-args set to attacker-controlled arguments. Triggering the connection test causes the worker process to execute that command with the privileges of the Prowler worker. Because workers are shared across tenants, execution can lead to cross-tenant data exposure, credential theft from environment variables, and lateral movement within the Prowler infrastructure.

python

# Patch excerpt: api/src/backend/api/v1/serializers.py
-KUBERNETES_KUBECONFIG_EXEC_ERROR = (
-    "Kubernetes kubeconfig exec authentication is not supported in Prowler Cloud "
-    "for security reasons."
+KUBERNETES_KUBECONFIG_UNSUPPORTED_COMMAND_AUTH_ERROR = (
+    "Kubernetes kubeconfig command-based authentication is not supported in "
+    "Prowler Cloud for security reasons."
 )
 KUBERNETES_KUBECONFIG_INVALID_ERROR = "Invalid Kubernetes kubeconfig content."


-def kubeconfig_contains_exec_auth(kubeconfig: dict) -> bool:
+def kubeconfig_contains_unsupported_command_auth(kubeconfig: dict) -> bool:
     users = kubeconfig.get("users", [])
     if not isinstance(users, list):
         raise ValidationError(KUBERNETES_KUBECONFIG_INVALID_ERROR)

Source: GitHub Commit 0b782fc

Detection Methods for CVE-2026-73263

Indicators of Compromise

Unexpected child processes spawned by the Prowler API worker or Celery worker process, particularly shells, curl, wget, or interpreters.
Kubeconfig payloads submitted to /api/v1/providers/{id}/connection containing auth-provider entries with a name of gcp and populated cmd-path or cmd-args fields.
Outbound network connections initiated from the Prowler worker host to unfamiliar destinations shortly after a provider connection test.

Detection Strategies

Inspect API access logs for POST requests to the provider connection endpoint and correlate them with subsequent process execution on the worker.
Deploy runtime process monitoring on Prowler worker containers to alert when subprocess.Popen invocations originate from Python threads handling kubeconfig loading.
Enable audit logging in the Prowler API and retain request bodies to permit retrospective analysis of submitted kubeconfig content.

Monitoring Recommendations

Baseline the process tree of Prowler workers and alert on deviations, especially non-Python child processes.
Monitor egress traffic from worker nodes for connections to non-Kubernetes endpoints.
Aggregate Prowler application logs into a centralized SIEM and alert on connection-test errors mentioning command-based authentication.

How to Mitigate CVE-2026-73263

Immediate Actions Required

Upgrade all Prowler API deployments to version 5.36.0 or later without delay.
Rotate any credentials, service account tokens, or cloud provider secrets accessible to the Prowler worker process.
Review submitted provider configurations for unexpected auth-provider blocks and delete suspicious entries.

Patch Information

The fix ships in Prowler 5.36.0. The patch renames kubeconfig_contains_exec_auth to kubeconfig_contains_unsupported_command_auth and extends validation to reject any kubeconfig that specifies command-based token retrieval, including legacy auth-provider structures. See the GitHub Security Advisory GHSA-ccqh-6cjc-wp4j, the Pull Request #12091, and the Prowler 5.36.0 Release Notes.

Workarounds

Restrict access to the provider connection API to trusted administrators until the upgrade completes.
Run Prowler workers under a least-privileged system account with no access to sensitive credentials or infrastructure.
Deploy workers inside restricted containers with seccomp or AppArmor profiles that block unexpected process execution.

bash

# Upgrade Prowler API to the fixed release
pip install --upgrade 'prowler>=5.36.0'

# Verify the installed version
prowler --version