CVE-2026-58490

Tracecat is an open-source security automation platform for teams and AI agents. From version 0.37.0 until 1.0.0-beta.49, Docker Compose deployments with SAML enabled can render SAML_SIGNED_ASSERTIONS and SAML_SIGNED_RESPONSES as empty values, overriding secure application defaults and disabling both signature requirements. An unauthenticated attacker who can reach the SAML assertion consumer endpoint can submit a forged unsigned response for an existing Tracecat user email address and obtain that user’s session. Targeting an existing superadmin can result in superadmin account takeover. Exploitation does not create users when SAML user creation is disabled and does not affect default Fargate or Helm deployments. Version 1.0.0-beta.49 removes the insecure deployment pass-through and requires signed assertions and responses.

• CWE-347

• https://github.com/TracecatHQ/tracecat/commit/018258ba6a17c36cbfa7ca977526c34fb6afc35f
• https://github.com/TracecatHQ/tracecat/commit/a97aafbfd667a6b9a3b7b524e1c1bfa9d8c59779
• https://github.com/TracecatHQ/tracecat/commit/dab64eb7ac0eb2088783ca14f4cb2d058547bfff
• https://github.com/TracecatHQ/tracecat/pull/2824
• https://github.com/TracecatHQ/tracecat/pull/2825
• https://github.com/TracecatHQ/tracecat/pull/2826
• https://github.com/TracecatHQ/tracecat/releases/tag/1.0.0-beta.49
• https://github.com/TracecatHQ/tracecat/security/advisories/GHSA-6g53-h6fh-c3pj

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Received

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-58485mcp-searxng is a Model Context Protocol server that gives AI…7.1
• CVE-2026-58486HedgeDoc is an open source, real-time, collaborative, markdo…8.3
• CVE-2026-58487HedgeDoc is an open source, real-time, collaborative, markdo…5.1
• CVE-2026-58488HedgeDoc is an open source, real-time, collaborative, markdo…6.9
• CVE-2026-58489HedgeDoc is an open source, real-time collaborative markdown…6.8
• CVE-2026-5849A vulnerability was determined in Tenda i12 1.0.0.11(3862). …9.8
• CVE-2026-58491Warpgate is an open source SSH, HTTPS and MySQL bastion host…9.3
• CVE-2026-58492grav-plugin-database is the database plugin for Grav CMS. Pr…9.2
• CVE-2026-58493grav-plugin-database is the database plugin for Grav CMS. Pr…5.1
• CVE-2026-58494Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.…6.5
• CVE-2026-58496Thor Vector Graphics (ThorVG) is a production-ready vector g…4.3
• CVE-2026-58497Uni-CLI gives people and agents one command interface for we…8.6