CVE-2026-58490

Summary

A SAML configuration flaw in Tracecat (versions 0.37.0–1.0.0-beta.48) allows unauthenticated attackers to bypass signature enforcement by submitting unsigned SAML responses when SAML_SIGNED_ASSERTIONS and SAML_SIGNED_RESPONSES are set to empty values, enabling session hijacking of existing users—including superadmins—via forged assertions.

Exploitability

Exploitation is straightforward for unauthenticated attackers who can reach the SAML assertion consumer endpoint and know a valid user email address; it requires no prior access or user interaction.

Blast radius

Successful exploitation grants full session takeover of targeted users, potentially leading to complete platform compromise if a superadmin account is hijacked, affecting confidentiality, integrity, and availability as per CVSS.

Detection

Look for SAML responses received at the assertion consumer endpoint (e.g., /saml/acs) that lack required signature elements (e.g., missing <ds:Signature> or empty Signature/Assertion elements) while the system is configured to require signatures; such malformed but accepted responses indicate exploitation attempts.

Prioritized remediation

Upgrade to Tracecat version 1.0.0-beta.49 or later, which removes the insecure deployment pass-through and enforces signed assertions and responses.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.