CVE-2026-73264

Name of the Vulnerable Software and Affected Versions Prowler versions prior to 5.33.1

Description An authenticated user with Lighthouse provider configuration access can provide an unvalidated base url for the openai compatible provider. This occurs through the endpoints 'POST /api/v1/lighthouse/providers' and 'POST /api/v1/lighthouse/providers/{id}/connection'. Consequently, the file api/src/backend/tasks/jobs/lighthouse providers.py may send outbound requests, including the API key in the Authorization header, to internal or attacker-controlled endpoints when the client.models.list function is called. This is a Server-Side Request Forgery (SSRF), which is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations Update to version 5.33.1.