CVE-2026-73264: prowler < 5.33.1

Affected technology

prowler · < 5.33.1
prowler-cloud

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

An authenticated user with Lighthouse provider configuration access could supply an unvalidated base_url for the openai_compatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/{id}/connection, causing api/src/backend/tasks/jobs/lighthouse_providers.py to send outbound requests, including the API key in the Authorization header, to attacker-controlled or internal endpoints when client.models.list was called. Vendor/CNA’s CVSS 3.1 assessment (base score 7.6/10) rates confidentiality impact as high; integrity impact as low; availability impact as none.