Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-59151

CVE-2026-59151CRITICAL

prowler-cloud prowler — Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  H  H  N    9.6   .0053   43.1     —

AFFECTED
  Product  Versions    Fixed
  prowler  < 5.30.3 –  —

TIMELINE
  Jul 2   Reserved by GitHub_M
  Jul 10  Published (CNA: GitHub_M)
  Aug 26  EXPLOIT PUBLISHED — CVE-2026-59151 (prowler-cloud prowler). Public exploit reference added.

CWE-287 · CNA: GitHub_M · CVSS v3.1 · 5 references · NVD status: Analyzed

Description

Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration. An authenticated attacker with a controlled SAML IdP could complete a valid SAML flow for an attacker-controlled domain while asserting an email address from another configured domain, causing a SAMLToken and tenant-scoped JWT to be issued for the wrong tenant and enabling cross-tenant account takeover. This issue is fixed in version 5.30.3.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
July 2, 2026	Reserved	Reserved by GitHub_M
July 10, 2026	Published	Published (CNA: GitHub_M)
August 26, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-59151 (prowler-cloud prowler). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
prowler-cloud	prowler	—	< 5.30.3	—

Weaknesses

CWE-287

References (5)

https://github.com/prowler-cloud/prowler/commit/bf3b5c2ba713e533014927141b64948c82c8f32e [Patch]
https://github.com/prowler-cloud/prowler/commit/f5ff30ad175bd2edf02cd28872653c1cda5867b7 [Patch]
https://github.com/prowler-cloud/prowler/pull/11650 [Issue Tracking]
https://github.com/prowler-cloud/prowler/releases/tag/5.30.3 [Release Notes]
https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp [Exploit, Vendor Advisory]

Authoritative record: CVE-2026-59151 at cve.org

Vendors: prowler-cloud

Weaknesses: CWE-287

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-59151 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.