CVE-2026-73264: Prowler Cloud Security Platform SSRF Flaw

CVE-2026-73264 Overview

CVE-2026-73264 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Prowler, an open-source cloud security platform. Versions prior to 5.33.1 accept an unvalidated base_url value for the openai_compatible Lighthouse provider. An authenticated user with Lighthouse provider configuration access can submit a crafted base_url through POST /api/v1/lighthouse/providers or POST /api/v1/lighthouse/providers/{id}/connection. When client.models.list executes, the backend sends outbound HTTP requests, including the configured API key in the Authorization header, to attacker-controlled or internal endpoints. The issue is fixed in Prowler 5.33.1.

Critical Impact
Authenticated attackers can coerce Prowler to leak API keys to arbitrary endpoints and reach internal network services via SSRF.

Affected Products

Prowler cloud security platform versions prior to 5.33.1
Deployments using the Lighthouse openai_compatible provider integration
Fixed releases: Prowler 5.33.1 and 5.34.0

Discovery Timeline

2026-08-12 - CVE-2026-73264 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73264

Vulnerability Analysis

The vulnerability resides in api/src/backend/tasks/jobs/lighthouse_providers.py, which handles connection tests for Lighthouse AI providers. When a user configures an openai_compatible provider, the backend instantiates an OpenAI-compatible client using the user-supplied base_url and API key. Calling client.models.list triggers an outbound HTTP request to that URL.

Because the endpoint accepts any URL string, an attacker can point base_url at internal services such as cloud metadata endpoints (for example, 169.254.169.254), intranet hosts, or attacker-controlled infrastructure. The provider API key is sent in the Authorization header of that outbound request, exposing the secret to any destination the attacker specifies.

Root Cause

The root cause is missing input validation on the base_url field. Prowler did not restrict the scheme, host, or address range before invoking the OpenAI client. This classic SSRF pattern [CWE-918] allows the server to act as a proxy for the attacker while also functioning as a credential exfiltration primitive.

Attack Vector

Exploitation requires an authenticated user who holds Lighthouse provider configuration privileges. The attacker submits a POST request to /api/v1/lighthouse/providers or /api/v1/lighthouse/providers/{id}/connection with a base_url referencing an internal host or a listener they control. When Prowler validates the connection, it issues the outbound request and delivers the API key to that endpoint. Refer to the GitHub Security Advisory GHSA-fhj4-q47f-w7mv for full technical details.

Detection Methods for CVE-2026-73264

Indicators of Compromise

Lighthouse provider configurations containing base_url values pointing to RFC1918 addresses, localhost, 127.0.0.1, or cloud metadata IPs such as 169.254.169.254.
Outbound HTTP requests from the Prowler backend to unexpected external hosts carrying Authorization: Bearer headers.
Unusual activity or new entries in the lighthouse_providers table with unfamiliar endpoints.

Detection Strategies

Review Prowler API access logs for POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/{id}/connection calls, correlating with the submitted base_url.
Inspect application logs from api/src/backend/tasks/jobs/lighthouse_providers.py for connection tests that resolved to internal or non-OpenAI-compatible hosts.
Alert on egress traffic from Prowler workers to destinations that are not on an approved provider allowlist.

Monitoring Recommendations

Enable network egress logging on the Prowler backend and forward records to a centralized SIEM for correlation.
Track privileged actions on Lighthouse provider objects and require change review for new or modified providers.
Rotate any Lighthouse provider API keys immediately if suspicious base_url values are observed.

How to Mitigate CVE-2026-73264

Immediate Actions Required

Upgrade Prowler to version 5.33.1 or later, or move to 5.34.0, as published in the Prowler Release v5.33.1 notes.
Audit existing Lighthouse providers and remove any entries with unexpected base_url values.
Rotate all API keys previously stored in Lighthouse openai_compatible provider configurations.

Patch Information

The fix is delivered in Prowler 5.33.1 via pull request #11928 and pull request #11940. Code changes are captured in the first commit and second commit, which add validation of the base_url before outbound requests are issued.

Workarounds

Restrict who can configure Lighthouse providers by limiting the role or permission set that grants access to the provider APIs.
Enforce network-level egress filtering so the Prowler backend can only reach approved AI provider endpoints, blocking internal ranges and metadata IPs.
Temporarily disable the openai_compatible Lighthouse provider until the upgrade is deployed.

bash

# Configuration example
# Upgrade Prowler to a patched release
pip install --upgrade 'prowler>=5.33.1'

# Or pull the patched container image
docker pull prowlercloud/prowler:5.33.1