✨ New features to highlight in this version

Enjoy them all now for free at https://cloud.prowler.com/

☁️ AWS — ISO Partitions

Prowler now resolves regions and services for the AWS ISO partitions (aws-iso, aws-iso-b, aws-iso-e and aws-iso-f) the same way it does for the commercial, China, European Sovereign Cloud and GovCloud partitions. The region matrix is filled from the endpoint metadata bundled with botocore, which needs no credentials or network access, so it covers partitions that are air-gapped from the internet. Scanning them no longer requires a hand-edited aws_regions_by_service.json: ISO regions such as us-isob-east-1 are accepted by --region and --excluded-region.

Deployments that declare PROWLER_AWS_PARTITION also keep their bootstrap STS calls in the configured region when it belongs to that partition. An install in us-gov-west-1 that reaches AWS only through its own VPC endpoints is no longer sent to us-gov-east-1, where the connection check and the scan used to time out.

Read more in the AWS Regions and Partitions documentation.

⏱️ AWS — Configurable Timeouts for Restricted Networks

Scans from networks with restricted egress (VPC endpoints for only some services, GovCloud or private deployments) could take hours: Boto3 waits 60 seconds to connect by default and retries connection errors, so every service without a reachable endpoint cost up to four 60-second attempts in every region. Prowler now lowers the default connect timeout to 10 seconds, keeps the read timeout at 60 seconds, and exposes both through --aws-connect-timeout and --aws-read-timeout, or through the PROWLER_AWS_BOTO3_CONNECT_TIMEOUT and PROWLER_AWS_BOTO3_READ_TIMEOUT environment variables for deployments without a CLI. --aws-retries-max-attempts 0 now disables retries instead of silently falling back to three, leaving a single attempt per call.

Read more in the Boto3 configuration documentation.

🐳 Image Provider — Reusable Vulnerability Database

The Image provider now honors TRIVY_CACHE_DIR. When the variable names a directory, Trivy keeps its vulnerability database there and Prowler leaves the directory in place after the scan, so the database is downloaded once instead of on every scan. Hosts without internet access can now scan images by pointing TRIVY_CACHE_DIR at a pre-populated database and setting TRIVY_SKIP_DB_UPDATE=true. Without the variable, the temporary cache is created and removed as before.

Read more in the Image provider documentation.

🎫 Jira Integration — Faster Connection Test

Testing a Jira integration no longer reports a false failure on accounts with many projects. The connection test fetched the issue types of every project one request at a time, which could outlast the wait in the UI even when the check was about to succeed. Issue types are now fetched concurrently, a project whose issue types the integration user cannot see is no longer logged as an error, and the Integrations page keeps following the connection test instead of giving up after about a minute.

Read more in the Jira integration documentation.

📚 Compliance — Catalog Integrity Fixes

A new integrity test runs over every compliance framework, asserting unique requirement IDs, no check listed twice within a requirement, and that every referenced check exists for its provider. The fixes it drove span 42 frameworks across AWS, Azure, GCP, GitHub, Kubernetes and Microsoft 365:

• Duplicate requirement IDs: identical copies are removed, and distinct requirements that shared an ID get their own, such as 1.10 in CIS AWS 5.0 and rc_rp_1 for RC.RP-1 in NIST CSF 1.1. In Prowler ThreatScore for Azure, SQL auditing retention moves from 3.2.1 to 3.2.4, and requirement 1.2.1 of Prowler ThreatScore for GCP now points to iam_sa_no_user_managed_keys.
• Stale check references: checks that no longer exist are replaced with their current name when there is a direct equivalent, or removed so the requirement reports as manual. Most of these were in the FedRAMP 20x KSI frameworks.

Renamed requirement IDs appear as new requirements for scans run after the upgrade.

The compliance overview task that runs after every scan is also faster: ThreatScore mappings are read once from the compliance template instead of from every finding, and rows are inserted with time-ordered uuid7 IDs grouped by framework and requirement.

Read more in the Compliance documentation.

🔍 Checks

rolesanywhere_profile_restricts_session_permissions, iam_role_service_trust_restricts_source_to_account and codebuild_project_uses_allowed_github_organizations no longer crash with TypeError when the scanning role is denied iam:ListRoles, which dropped every finding of those checks for the account. Without the role inventory, an enabled IAM Roles Anywhere profile without session scoping reports MANUAL, and CodeBuild projects whose service role cannot be resolved are skipped.

Explore all AWS checks at Prowler Hub.

🔐 Security Updates

• next upgraded to 16.3.3 in the UI, patching unauthenticated remote code execution through AVIF image optimization (GHSA-2xp9-vwfh-vxw4) and on Windows-hosted servers (GHSA-p293-qw3h-jr36).
• sharp upgraded to 0.35.4 in the UI, patching libheif image-decoding vulnerabilities (GHSA-rgj7-g3m4-5g8c).
• nanoid, js-yaml and postcss, plus eleven transitive UI dependencies, upgraded to patched versions, resolving 40 npm audit advisories (21 high, 15 moderate, 4 low).
• libuuid upgraded to 2.41.6-r1 in the MCP Server image, patching CVE-2026-53612, CVE-2026-53613, CVE-2026-53614, CVE-2026-76642, CVE-2026-78408 and CVE-2026-78410.

UI

🚀 Added

• PostHog Toolbar support in development with separate ingestion and app hosts (#12582)

🐞 Fixed

• Scan Jobs onboarding tour no longer targets an unmounted In Progress row from other tabs (#12705)
• Integration connection test polling now waits up to ~3 minutes instead of ~57 seconds before giving up, so it no longer reports a false failure on slower checks (e.g. Jira accounts with many projects) that were still going to succeed (#12742)
• Scans page filter widths and action button styling, with Launch Scan and Import Findings grouped beside the tabs and sized consistently with Configure Mutelist (#12781)

🔐 Security

• nanoid to 5.1.16, js-yaml to 4.3.1 and postcss to 8.5.23, plus transitive hono, @hono/node-server, browserslist, qs, dompurify, brace-expansion, fast-uri, ip-address, mermaid, body-parser and @humanfs/node to patched versions, resolving 40 npm audit advisories (21 high, 15 moderate, 4 low) (#12758)
• next to 16.3.3, patching an unauthenticated remote code execution in the Image Optimization API when AVIF files are used (GHSA-2xp9-vwfh-vxw4) (#12778)
• sharp to 0.35.4, patching two libheif vulnerabilities reachable through image decoding (GHSA-rgj7-g3m4-5g8c) (#12778)

API

🔄 Changed

• Speed up compliance overview ingestion by reading ThreatScore mappings from the compliance template instead of each finding, generating time-ordered uuid7 row ids and grouping inserted rows by framework and requirement (#12738)

SDK

🚀 Added

• AWS ISO partitions (aws-iso, aws-iso-b, aws-iso-e and aws-iso-f) to the AWS service region matrix, generated from the endpoints data bundled with botocore (#12759)
• --aws-connect-timeout and --aws-read-timeout CLI flags, plus PROWLER_AWS_BOTO3_CONNECT_TIMEOUT and PROWLER_AWS_BOTO3_READ_TIMEOUT environment variables, to bound how long each AWS API call waits for an endpoint (#12774)

🔄 Changed

• AWS provider default Boto3 connect timeout lowered from 60 to 10 seconds, so scans in restricted-egress networks (VPC endpoints for a subset of services, GovCloud, private deployments) no longer spend 4 minutes per region on every service whose endpoint is unreachable (#12774)

🐞 Fixed

• Duplicate requirement ids, checks listed twice in a requirement and references to non-existent checks across compliance frameworks, now guarded by a catalog integrity test (#12717)
• Duplicate requirement 3.2.1 in ProwlerThreatScore for Azure (SQL auditing retention is now 3.2.4) and doubled check id in requirement 1.2.1 of ProwlerThreatScore for GCP (#12717)
• Jira connection checks no longer log an error when a single project has no issue types visible to the integration user (typically a missing "create issue" permission on that project), a case the caller already treats as non-fatal (#12742)
• Jira.test_connection() now fetches each project's issue types concurrently instead of one request at a time, so accounts with many Jira projects no longer take tens of seconds (unbounded, scaling with the project count) to verify the connection (#12742)
• AwsProvider.get_available_aws_service_regions() now returns an empty set for an unknown service or partition instead of raising KeyError, so a service unavailable in the audited partition is skipped (#12759)
• AwsProvider.generate_regional_clients() now returns an empty dict instead of None when the regional clients cannot be built, a failure that surfaced later as AttributeError: 'NoneType' object has no attribute 'values' (#12759)
• AwsProvider.get_global_region() now returns a real region for each ISO partition instead of the aws-iso-global pseudo endpoint, which collapsed the four partitions into one answer (#12759)
• Bootstrap STS calls now use the session region when PROWLER_AWS_PARTITION is set and the region belongs to that partition, instead of always going to the partition's global STS region, which a deployment reached only through its own region's VPC endpoints cannot route to (#12764)
• The Image provider now uses the directory named by TRIVY_CACHE_DIR when one is set, instead of a fresh temporary directory it deletes afterwards, so a deployment can supply a vulnerability database it already holds and one with network access stops re-downloading the database for every image it scans (#12773)
• --aws-retries-max-attempts 0 now disables Boto3 retries instead of being silently ignored in favour of the default of 3 (#12774)
• rolesanywhere_profile_restricts_session_permissions, iam_role_service_trust_restricts_source_to_account and codebuild_project_uses_allowed_github_organizations crashing with TypeError when iam:ListRoles is denied (#12785)

MCP

🔐 Security

• libuuid upgraded to 2.41.6-r1 in the container image, patching CVE-2026-53612, CVE-2026-53613, CVE-2026-53614, CVE-2026-76642, CVE-2026-78408 and CVE-2026-78410 (#12780)