Vulnerability details

Tracecat is an open-source security automation platform for teams and AI agents. From version 0.37.0 until 1.0.0-beta.49, Docker Compose deployments with SAML enabled can render SAML_SIGNED_ASSERTIONS and SAML_SIGNED_RESPONSES as empty values, overriding secure application defaults and disabling both signature requirements. An unauthenticated attacker who can reach the SAML assertion consumer endpoint can submit a forged unsigned response for an existing Tracecat user email address and obtain that user’s session. Targeting an existing superadmin can result in superadmin account takeover. Exploitation does not create users when SAML user creation is disabled and does not affect default Fargate or Helm deployments. Version 1.0.0-beta.49 removes the insecure deployment pass-through and requires signed assertions and responses.

• https://github.com/TracecatHQ/tracecat/security/advisories/GHSA-6g53-h6fh-c3pj x_refsource_CONFIRM
• https://github.com/TracecatHQ/tracecat/pull/2824 x_refsource_MISC
• https://github.com/TracecatHQ/tracecat/pull/2825 x_refsource_MISC
• https://github.com/TracecatHQ/tracecat/pull/2826 x_refsource_MISC
• https://github.com/TracecatHQ/tracecat/commit/018258ba6a17c36cbfa7ca977526c34fb6afc35f x_refsource_MISC
• https://github.com/TracecatHQ/tracecat/commit/a97aafbfd667a6b9a3b7b524e1c1bfa9d8c59779 x_refsource_MISC
• https://github.com/TracecatHQ/tracecat/commit/dab64eb7ac0eb2088783ca14f4cb2d058547bfff x_refsource_MISC
• https://github.com/TracecatHQ/tracecat/releases/tag/1.0.0-beta.49 x_refsource_MISC