CVE-2026-42354

Sentry is an error tracking and performance monitoring tool. From version 21.12.0 to before version 26.4.1, a critical vulnerability was discovered in the SAML SSO implementation of Sentry. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability. This issue has been patched in version 26.4.1.

• CWE-290

• https://github.com/getsentry/sentry/commit/0c67558ae7fe08738912d4c5233b53ead048da3bPatch
• https://github.com/getsentry/sentry/pull/113720Issue Tracking, Patch
• https://github.com/getsentry/sentry/releases/tag/26.4.1Product, Release Notes
• https://github.com/getsentry/sentry/security/advisories/GHSA-rcmw-7mc7-3rj7Mitigation, Vendor Advisory

Published

May 8, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42349Clerk JavaScript is the official JavaScript repository for C…8.1
• CVE-2026-4235A weakness has been identified in itsourcecode Online Enroll…7.3
• CVE-2026-42350Kargo manages and automates the promotion of software artifa…5.1
• CVE-2026-42351pygeoapi is a Python server implementation of the OGC API su…7.5
• CVE-2026-42352pygeoapi is a Python server implementation of the OGC API su…8.6
• CVE-2026-42353i18next-http-middleware is a middleware to be used with Node…8.2
• CVE-2026-42355NanaZip is an open source file archive. From 5.0.1252.0 to b…5.5
• CVE-2026-42357Incorrect Authorization vulnerability allows users to access…6.5
• CVE-2026-42358A bug in Apache Airflow's Variable response masker caused ne…6.5
• CVE-2026-42359A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2…8.8
• CVE-2026-4236A security vulnerability has been detected in itsourcecode O…7.3
• CVE-2026-42360A bug in Apache Airflow's rendered-template field handling c…6.5