CVE-2026-73263: Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path
Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfigcontent containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfigcontainsexecauth in api/src/backend/api/v1/serializers.py checked only exec blocks, and POST /api/v1/providers/{id}/connection loaded it through config.loadkubeconfigfromdict in prowler/providers/kubernetes/kubernetesprovider.py, causing kubernetes-python CommandTokenSource.token to run the attacker-supplied command through subprocess.Popen on the shared worker. This issue is fixed in version 5.36.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Prowler Kubernetes providerto a version that resolves this vulnerability.Fixed in 5.36.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73263?
The severity of CVE-2026-73263 is critical with a CVSS score of 9.9.
What type of vulnerability is CVE-2026-73263?
CVE-2026-73263 is classified as an OS Command Injection vulnerability.
How do I fix CVE-2026-73263?
To fix CVE-2026-73263, upgrade Prowler to version 5.36.0 or later.
What impact does CVE-2026-73263 have?
CVE-2026-73263 allows for remote code execution via the Prowler app workers using compromised kubeconfig files.
Who is affected by CVE-2026-73263?
Any user of Prowler prior to version 5.36.0 that utilizes the Kubernetes provider with legacy GCP auth-provider configurations is affected by CVE-2026-73263.