CVE-2026-73263

CVE-2026-73263 lives in Prowler's Kubernetes connection test endpoint—a function that verifies credentials work before running security scans. An attacker who can POST a crafted kubeconfig containing a GCP auth-provider block to /api/v1/providers/{id}/connection triggers arbitrary command execution through kubernetes-python's CommandTokenSource. The detection gap is straightforward: the original validation checked for `exec:` blocks but never accounted for auth-provider config.cmd-path and config.cmd-args, which achieve identical execution through the same underlying library call. The low EPSS of 0.00352 against a 9.9 CVSS is a warning sign in itself. Automated prioritization would deprioritize this precisely because mass scanners don't probe kubernetes-python integration paths—they find what signatures exist to find. This was likely discovered through targeted code review or active probing, which means the exposure window between introduction and detection is opaque. The CVE dating artifact retroactively labels something as known-and-remediated while obscuring how long it circulated. The fix in 5.36.0 needs careful scrutiny. If it added a second check for auth-provider exec alongside the first for exec blocks, that's a surgical patch that will break again when kubernetes-python adds a third execution path. The structural question is whether the API now rejects any kubeconfig containing command execution capability, or merely enumerates known vectors. Engineers auditing their Prowler deployments should pull the diff and verify the remediation scope directly. Beyond this specific CVE, treat this as a class indicator. Security tooling that ingests user-controlled configuration files consistently categorizes those inputs as 'configuration' rather than 'untrusted data,' and the blast radius reflects that failure. When Prowler runs on a shared worker with credentials to scan your cloud environment, compromising it collapses the audit-target boundary—attackers gain not just the worker but the ability to manipulate scan outputs, creating detection gaps that persist because the auditing surface itself is compromised. The architectural question isn't whether your Prowler instance has this CVE patched; it's whether your security tooling runs on infrastructure that would let a single exploitation pivot across tenants, projects, or clusters.

Reviewed through automated stages and approved by a human before publication.