CVE-2026-73263

Name of the Vulnerable Software and Affected Versions Prowler versions prior to 5.36.0

Description The Kubernetes provider connection test fails to properly validate kubeconfig content containing a legacy GCP auth-provider. Specifically, the kubeconfig contains exec auth function in api/src/backend/api/v1/serializers.py only checks exec blocks, while the 'POST /api/v1/providers/{id}/connection' endpoint loads the configuration via config.load kube config from dict in prowler/providers/kubernetes/kubernetes provider.py. This allows an attacker to supply malicious commands through config.cmd-path and config.cmd-args, which are then executed via subprocess.Popen by the CommandTokenSource.token function in the kubernetes-python library on the shared worker, leading to remote code execution.

Recommendations Update to version 5.36.0.