CVE-2026-73263 prowler-cloud CVE debrief

Who should care

Defenders responsible for cloud security, specifically those using Prowler, should assess exposure and prioritize upgrading to version 5.36.0 or later. They should also review and restrict kubeconfig_content to prevent legacy gcp auth-provider usage and monitor for suspicious activity on the shared worker. Additionally, defenders should verify kubeconfig_content restrictions and consider compensating controls for exposed systems.

Why it matters

Defenders should prioritize upgrading to version 5.36.0 or later to prevent potential command execution on the shared worker. This vulnerability could allow an attacker to execute arbitrary commands, compromising cloud security infrastructure and potentially exposing sensitive data or credentials.

• Potential command execution on the shared worker
• Exposure of sensitive data or credentials
• Compromise of cloud security infrastructure
• Verification of kubeconfig_content restrictions

Technical summary

The Kubernetes provider connection test in Prowler accepted kubeconfig_content containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args, allowing an attacker to execute arbitrary commands on the shared worker. This issue was fixed in version 5.36.0. Defenders should prioritize upgrading to version 5.36.0 or later to prevent potential command execution. The vulnerability existed due to insufficient validation of kubeconfig_content, highlighting the need for stricter validation and monitoring of Kubernetes provider connections.

Defensive priority

Defenders should prioritize upgrading to version 5.36.0 or later to prevent potential command execution.

Recommended defensive actions

• Upgrade to Prowler version 5.36.0 or later
• Review and restrict kubeconfig_content to prevent legacy gcp auth-provider usage
• Monitor for suspicious activity on the shared worker
• Verify kubeconfig_content restrictions
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets
• technicalSummary

Evidence notes

The vulnerability exists in the Kubernetes provider connection test, which accepted kubeconfig_content containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args. This allowed an attacker to execute arbitrary commands on the shared worker. The issue was addressed in version 5.36.0. Defenders should verify kubeconfig_content restrictions and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.