CVE-2026-73263 in Prowler
Summary
by MITRE • 08/12/2026
Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfig_content containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfig_contains_exec_auth in api/src/backend/api/v1/serializers.py checked only exec blocks, and POST /api/v1/providers/{id}/connection loaded it through config.load_kube_config_from_dict in prowler/providers/kubernetes/kubernetes_provider.py, causing kubernetes-python CommandTokenSource.token to run the attacker-supplied command through subprocess.Popen on the shared worker. This issue is fixed in version 5.36.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability in Prowler's Kubernetes provider functionality represents a critical command injection flaw that could enable remote code execution on systems running the cloud security platform. This security weakness existed in versions prior to 5.36.0 and specifically affected how the system handled kubeconfig files containing legacy Google Cloud Platform authentication providers. The vulnerability stems from insufficient validation of kubeconfig content during the connection testing process, creating an attack vector where malicious actors could inject arbitrary commands through carefully crafted configuration data.
The technical implementation of this flaw occurs within the api/src/backend/api/v1/serializers.py file where the kubeconfig_contains_exec_auth function performs only partial validation of authentication provider configurations. This function specifically checks for exec blocks but fails to properly validate legacy gcp auth-provider configurations that contain cmd-path and cmd-args parameters. When a user submits a kubeconfig containing such malicious configuration through the POST /api/v1/providers/{id}/connection endpoint, the system processes this through the config.load_kube_config_from_dict function in prowler/providers/kubernetes/kubernetes_provider.py. The kubernetes-python library's CommandTokenSource.token method then executes the attacker-supplied command via subprocess.Popen, effectively allowing arbitrary code execution on the shared worker environment where Prowler operates.
This vulnerability directly maps to CWE-78, which describes improper neutralization of special elements used in OS commands, and CWE-94, covering improper control of generation of code. The attack vector aligns with ATT&CK technique T1059.003 for command and scripting interpreter, specifically focusing on the use of bash or other shells to execute commands. The operational impact extends beyond simple remote code execution as it compromises the integrity of the entire cloud security platform, potentially allowing attackers to gain access to sensitive infrastructure data, manipulate security assessments, or pivot to other systems within the network environment where Prowler is deployed.
The security implications are particularly severe given that Prowler serves as a cloud security platform, meaning any compromise could provide attackers with elevated privileges and access to critical infrastructure monitoring capabilities. The vulnerability affects the shared worker environment, potentially allowing attackers to execute commands with the privileges of the worker process, which typically have broad access to system resources and potentially to other services or data within the same network segment. Organizations using Prowler in their security operations would be particularly vulnerable as this issue could be exploited by adversaries to compromise their cloud security posture rather than simply detecting vulnerabilities in their infrastructure.
The fix implemented in version 5.36.0 addresses this vulnerability by enhancing the kubeconfig validation process to properly check and sanitize all authentication provider configurations, including legacy gcp auth-provider entries with cmd-path and cmd-args parameters. This remediation ensures that only properly validated authentication methods are accepted, preventing the execution of arbitrary commands through the Kubernetes provider connection testing functionality. Security practitioners should immediately update to version 5.36.0 or later to protect their environments from this critical command injection vulnerability that could enable full compromise of cloud security monitoring capabilities.