CVE-2026-73264

HIGH 7.6

Prowler: Server-Side Request Forgery (SSRF) in Lighthouse Provider

CVSS Score

7.6

EPSS Score

0.0%

EPSS Percentile

0th

Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated base_url for the openai_compatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/{id}/connection, causing api/src/backend/tasks/jobs/lighthouse_providers.py to send outbound requests, including the API key in the Authorization header, to attacker-controlled or internal endpoints when client.models.list was called. This issue is fixed in version 5.33.1.

CWE	CWE-918
Vendor	prowler-cloud
Product	prowler
Published	Aug 12, 2026
Last Updated	Aug 12, 2026

Stay Ahead of the Next One

Get instant alerts for prowler-cloud prowler

Be the first to know when new high vulnerabilities affecting prowler-cloud prowler are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Affected Versions

prowler-cloud / prowler

< 5.33.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/prowler-cloud/prowler/security/advisories/GHSA-fhj4-q47f-w7mv github.com: https://github.com/prowler-cloud/prowler/pull/11928 github.com: https://github.com/prowler-cloud/prowler/pull/11940 github.com: https://github.com/prowler-cloud/prowler/commit/1c4d8e3e756ee04367353101af797004d1c0258f github.com: https://github.com/prowler-cloud/prowler/commit/3f2e5929d9ff3c1a5d2fae49f8edd419ee99a8e2 github.com: https://github.com/prowler-cloud/prowler/releases/tag/5.33.1 github.com: https://github.com/prowler-cloud/prowler/releases/tag/5.34.0