CVE-2026-100169 Prowler CVE debrief

Who should care

Defenders responsible for Prowler deployments, SAML configurations, and tenant access management should assess exposure and prioritize remediation. They should verify SAML configurations, restrict tenant access, and monitor for suspicious activity to prevent potential cross-tenant account takeover and unauthorized access. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and to  

Why it matters

Defenders should prioritize verifying SAML configurations, restricting tenant access, and monitoring for suspicious activity to prevent potential cross-tenant account takeover and unauthorized access.

• Potential cross-tenant account takeover
• Unauthorized access to sensitive resources
• Compromised tenant security posture

Technical summary

The vulnerability is caused by the SAML ACS finish logic recalculating the tenant from the asserted user email domain instead of binding token issuance to the tenant associated with the validated SAML configuration. This allows a malicious tenant with its own SAML configuration and a self-controlled IdP to complete a valid SAML flow for its own configured domain while asserting an email address from another configured domain. The confirmed root cause lies in the ACS finish and token issuance flow, where the flow selects a SAML configuration through the ACS route but later recalculates the tenant from the asserted user email domain.

Defensive priority

Defenders should prioritize verifying SAML configurations, restricting tenant access, and monitoring for suspicious activity.

Recommended defensive actions

• Verify SAML configurations for uniqueness and correctness
• Restrict tenant access to sensitive resources
• Monitor for suspicious activity and token issuance
• Update to version 5.30.3 or later
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability is caused by the SAML ACS finish logic recalculating the tenant from the asserted user email domain instead of binding token issuance to the tenant associated with the validated SAML configuration.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.