CVE-2026-58490

Name of the Vulnerable Software and Affected Versions Tracecat versions 0.37.0 through 1.0.0-beta.48

Description In Docker Compose deployments with SAML enabled, the application may render SAML SIGNED ASSERTIONS and SAML SIGNED RESPONSES as empty values. This behavior overrides secure defaults and disables signature requirements. An unauthenticated attacker can exploit this by sending a forged unsigned response to the SAML assertion consumer endpoint using an existing user email address to hijack that user's session. If a superadmin account is targeted, it can lead to a full account takeover. This issue does not affect default Fargate or Helm deployments, nor does it allow user creation if SAML user creation is disabled.

Recommendations Update to version 1.0.0-beta.49.