External risk intelligence

Prowler Kubernetes Provider Command Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-73263

Prowler is a cloud security assessment tool typically used by developers or security teams in internal environments to audit infrastructure. While it may have API endpoints for management, it is generally not exposed to the public internet as a standard internet-facing service.

OS Command Injection

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in the Prowler cloud security platform that could allow an attacker to execute commands on the shared worker environment. This issue arises from how Prowler processes Kubernetes connection details, specifically when using legacy authentication methods. While Prowler is primarily used for internal security assessments, the potential for command execution warrants attention to confirm if your environment is affected.

It lets attackers run commands on cloud security tools.
Leadership should remember it impacts critical cloud security tools.
Confirm if Prowler is used and assess its specific exposure.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access to the Prowler cloud security platform could craft a malicious Kubernetes configuration. When Prowler tests the connection to a Kubernetes provider using this configuration, it would execute an attacker-supplied command on the shared worker. This could lead to significant compromise of the worker's environment.

Authenticated access required.
Triggered by connection test with malicious config.
Risk of code execution on worker.

Live Threat

Current exploitation, exposure, and threat context

The Kubernetes provider in Prowler could be tricked into running an attacker-supplied command when processing a kubeconfig containing a legacy GCP auth-provider. This could occur when the connection test for a Kubernetes provider is performed, potentially affecting the shared worker.

System commands on the worker.
An attacker-supplied command is executed.
Compromised worker, potentially impacting operations.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Prowler Cloud Security Platform's Kubernetes provider is affected by a critical vulnerability. Teams responsible for cloud security tooling, Kubernetes infrastructure, and application platforms should collaborate to address this. The immediate first step is to inventory Prowler instances, assess their reachability and business criticality, identify the accountable owner, and then prioritize remediation actions based on risk.

Cloud security and platform teams own this.
Verify Prowler instances and reachability.
Plan vendor coordination or upgrades.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Prowler and how is it used?

Prowler is a cloud security platform designed to audit and assess the security posture of cloud environments. Security teams and developers typically deploy it to scan infrastructure configurations for misconfigurations and compliance issues. It often includes management interfaces to handle various provider connections, such as those for Kubernetes clusters.

What is the vulnerability in CVE-2026-73263?

This vulnerability is an instance of OS Command Injection (CWE-78). It occurs because the software fails to properly sanitize input when processing certain Kubernetes connection files. Consequently, an attacker can supply malicious commands that the system inadvertently executes, allowing them to run unauthorized actions directly on the underlying server.

How does an attacker trigger this command execution?

The flaw is triggered when Prowler tests a Kubernetes provider connection using a specially crafted configuration file that includes legacy authentication settings. If the configuration contains specific command-path or command-args fields, the system may process them unsafely. Simply having these configuration files present without initiating a connection test does not trigger the bug.

Do I need to worry if my Prowler instance is internal?

Halo Surface Signal indicates that Prowler is generally used for internal audits and is typically not exposed to the public internet. Because the vulnerability requires authenticated access to the platform to craft and submit the malicious configuration, internal-only instances face a lower risk profile than those reachable by unauthorized parties.

When should I update my Prowler installation?

You should prioritize updating to version 5.36.0 or later as soon as possible. The first practical step is to create an inventory of all your Prowler instances to determine which ones are running older versions. Once identified, coordinate with your infrastructure team to apply the patch, which specifically addresses the unsafe handling of Kubernetes connection inputs.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.