Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Tracecat is an open-source security automation platform for teams and AI agents. From version 0.37.0 until 1.0.0-beta.49, Docker Compose deployments with SAML enabled can render SAML_SIGNED_ASSERTIONS and SAML_SIGNED_RESPONSES as empty values, overriding secure application defaults and disabling both signature requirements. An unauthenticated attacker who can reach the SAML assertion consumer endpoint can submit a forged unsigned response for an existing Tracecat user email address and obtain that user’s session. Targeting an existing superadmin can result in superadmin account takeover. Exploitation does not create users when SAML user creation is disabled and does not affect default Fargate or Helm deployments. Version 1.0.0-beta.49 removes the insecure deployment pass-through and requires signed assertions and responses.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🆕 New CVE Tracecat: auth bypass in SAML login via unsigned responses (CVE-2026-58490) Remote attackers can forge unsigned SAML logins to hijack any existing user's session, including superadmins. Patch → 1.0.0-beta.49 https://cve.now/CVE-2026-58490?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
CVE-2026-58490 Tracecat is an open-source security automation platform for teams and AI agents. From version 0.37.0 until 1.0.0-beta.49, Docker Compose deployments with SAML enabled… https://www.cve.org/CVERecord?id=CVE-2026-58490
🆕 New CVE: CVE-2026-58490 (CVSS 9.8, Enclave score 6/10) Tracecat: Unsigned SAML response accepted in Docker Compose SAML deployments due to empty signing defaults Remote, no login needed. Tracecat is an open-source security automation platform for… https://app.enclave.ai/threat-feed/CVE-2026-58490