CVE-2026-73264: Prowler: Server-Side Request Forgery (SSRF) in Lighthouse Provider
Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated baseurl for the openaicompatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/{id}/connection, causing api/src/backend/tasks/jobs/lighthouseproviders.py to send outbound requests, including the API key in the Authorization header, to attacker-controlled or internal endpoints when client.models.list was called. This issue is fixed in version 5.33.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lighthouse Providerto a version that resolves this vulnerability.Fixed in 5.33.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73264?
CVE-2026-73264 has a severity rating of 7.6, indicating a high risk.
How do I fix CVE-2026-73264?
To remediate CVE-2026-73264, upgrade Prowler to version 5.33.1 or later.
What type of vulnerability is CVE-2026-73264?
CVE-2026-73264 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
Who is affected by CVE-2026-73264?
Authenticated users with Lighthouse provider configuration access in Prowler versions prior to 5.33.1 are affected.
What can an attacker do with CVE-2026-73264?
An attacker could exploit CVE-2026-73264 to supply an unvalidated base_url, potentially compromising the server.