Prowler: Server-Side Request Forgery (SSRF) in Lighthouse Provider
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated base_url for the openai_compatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/{id}/connection, causing api/src/backend/tasks/jobs/lighthouse_providers.py to send outbound requests, including the API key in the Authorization header, to attacker-controlled or internal endpoints when client.models.list was called. This issue is fixed in version 5.33.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| prowler-cloud | prowler | before 5.33.1 | 5.33.1 | Patch available | CNA |
- prowler Vendorprowler-cloud Affected before 5.33.1 Fixed in 5.33.1 Patch available CNA
Remediation
- Fix · CNA prowler (prowler-cloud) Fixed in 5.33.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-73264
References
Other 7
- https://github.com/prowler-cloud/prowler/security/advisories/GHSA-fhj4-q47f-w7mv
- https://github.com/prowler-cloud/prowler/pull/11928
- https://github.com/prowler-cloud/prowler/pull/11940
- https://github.com/prowler-cloud/prowler/commit/1c4d8e3e756ee04367353101af797004d1c0258f
- https://github.com/prowler-cloud/prowler/commit/3f2e5929d9ff3c1a5d2fae49f8edd419ee99a8e2
- https://github.com/prowler-cloud/prowler/releases/tag/5.33.1
- https://github.com/prowler-cloud/prowler/releases/tag/5.34.0
More prowler-cloud vulnerabilities
- TI-2026-51397 Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path CVSS 3.1CRITICAL 9.9
- TI-2026-51396 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags CVSS 3.1MEDIUM 5.4
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences