HighVulnerabilityLLM-specific
CVE-2026-73264: Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-73264
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
Prowler, a cloud security platform, failed to validate the base_url for its openai_compatible Lighthouse provider before version 5.33.1. An authenticated user with Lighthouse provider configuration access could set this URL through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/{id}/connection. When client.models.list ran, the job in api/src/backend/tasks/jobs/lighthouse_providers.py sent requests, including the API key in the Authorization header, to attacker-controlled or internal endpoints.
Mitigation
Fixed in 5.33.1.
Related items
- MediumCVE-2026-127202: MLflow path traversal through model_id in the log outputs APISimilar attack · NVD/CVE Database
- LowAI chatbots are recommending fake retail websites, study findsSimilar attack · The Verge (AI)
- MediumPalo Alto tracks a massive Chinese AI attack that sadly lives up to industry fearsSimilar attack · CSO Online
- MediumAttackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society SectorsSimilar attack · Palo Alto Unit 42
- MediumCVE-2026-126994: braindecode model config deserialization flaw via activation argumentSimilar attack · NVD/CVE Database