✨ New features to highlight in this version

Enjoy them all now for free at https://cloud.prowler.com/

🏛️ Compliance — FedRAMP 20x Consolidated Rules 2026

The FedRAMP 20x Phase One pilot frameworks (fedramp_20x_ksi_low_aws, fedramp_20x_ksi_low_azure and fedramp_20x_ksi_low_gcp) are replaced by two universal frameworks built from the FedRAMP Consolidated Rules for 2026, each covering AWS, Azure, GCP, Kubernetes and Microsoft 365 from a single definition:

• FedRAMP 20x KSI (fedramp_20x_ksi_2026): the 46 Key Security Indicators across 10 themes. There is one indicator catalog for every class instead of a separate Low fork; each indicator carries its class applicability and NIST SP 800-53 controls.
• FedRAMP 20x Class C FRR (fedramp_20x_frr_class_c_2026): the 158 FedRAMP Rules of the Class C ruleset that bind cloud service providers. Most are program obligations (reports, notifications, certification package) and stay manual; checks are mapped only where they evidence part of the rule text. Configurable checks carry configuration requirements, so a relaxed audit_config cannot turn a requirement green.

Automation or stored results that reference the pilot framework IDs need to move to fedramp_20x_ksi_2026. In Prowler App, both frameworks show the per-provider breakdown in the cross-provider compliance view and can be downloaded as OCSF.

Read more in the Compliance documentation.

🔎 AWS — Inspector Coverage, CISA KEV and FIPS Checks

Seven new AWS checks back the vulnerability detection and cryptography rules of FedRAMP 20x Class C:

• inspector2_coverage_scan_status_active and inspector2_coverage_recently_scanned report resources Amazon Inspector is not scanning, or last scanned more than inspector2_max_days_since_last_scan days ago (default 3).
• inspector2_active_findings_no_known_exploited_vulnerabilities and inspector2_active_findings_kev_within_due_date report active findings whose CVE is in the CISA Known Exploited Vulnerabilities catalog, and those still open past the CISA due date. The KEV data comes from Inspector itself through inspector2:BatchGetFindingDetails, so no external feed is needed.
• inspector2_active_findings_within_max_age reports active findings first observed more than inspector2_active_finding_max_age_days days ago (default 192).
• elbv2_listener_fips_tls_enabled and transfer_server_fips_security_policy_enabled report HTTPS/TLS load balancer listeners and Transfer Family servers without a FIPS security policy.

inspector2:BatchGetFindingDetails is not part of SecurityAudit, so it is now included in the Prowler additions policy and the CloudFormation scan role. Without it, the KEV checks report MANUAL naming the missing permission instead of a false FAIL.

Explore all AWS checks at Prowler Hub.

☁️ AWS — Partition Bootstrap Failover

When PROWLER_AWS_PARTITION is set, the bootstrap STS calls (validating credentials, assuming a role and getting an MFA session token) now try up to two more regions of the partition if the first one cannot be reached. A GovCloud host whose configured region belongs to another partition was still sent to us-gov-east-1, and on a network that routes only to us-gov-west-1 the connection check and the scan failed on perfectly valid credentials. Only connection errors and timeouts move on to the next region; credential errors are reported from the first one as before. Later STS calls reuse the region that answered, and nothing changes when PROWLER_AWS_PARTITION is unset.

Read more in the AWS Regions and Partitions documentation.

🌐 Azure — Sovereign Cloud Endpoints for Defender and Key Vault

Defender security contacts and Key Vault key rotation policies now use the endpoints of the cloud selected with --azure-region instead of the hardcoded management.azure.com and vault.azure.net hosts, so both work on AzureUSGovernment and AzureChinaCloud. Key Vault clients are built from the vault URI that Azure returns for each vault.

Read more in the Azure non-default cloud documentation.

✉️ Invitations — Expired Invitations No Longer Block Re-Invites

A pending invitation past its expiry date is now reported as expired, and inviting the same email again marks it as expired and creates the new invitation instead of returning a generic error. The Invitations table disables Edit and Revoke on expired and revoked invitations, and filter[state__in] on the invitations endpoint no longer returns a server error.

In Prowler Cloud, new organizations are offered an Invite your team step once the first provider is connected, and Prowler Private Cloud deployments can set UI_SELF_REGISTRATION_ENABLED=false to make sign-up invitation-only.

Read more in the Invitations documentation.

📄 Reports — Downloads on Self-Hosted Storage

Report downloads no longer depend on the storage host being the same inside and outside the container network. DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL signs the download URL against a browser-reachable host, so a deployment whose object storage answers only on an internal address serves the file instead of a link the browser cannot open. Leaving DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION unset, common on S3-compatible storage with no meaningful region, no longer makes the download fail with a server error.

🔍 Checks

• Huawei Cloud: new smn_topic_subscriptions check reports SMN topics without any subscription.
• Cloudflare: the API token links in the provider wizard request the SSL and Certificates, Bot Management and Zone WAF read permissions the checks need, so a token created from the wizard no longer produces failures on permissions it was never granted.
• Microsoft 365: five Defender malware, anti-phishing and inbound anti-spam checks no longer fail with KeyError on tenants that use the Standard or Strict preset security policies, which dropped every finding of those checks. Preset policies are covered by defender_strict_preset_security_policy_enabled.
• Google Workspace: security_2sv_enforced reports domain-wide 2-Step Verification failures as FAIL even when every failing setting is overridden for a group or organizational unit.

Explore all checks at Prowler Hub.

🔐 Security Updates

• libsqlite3-0, gzip, perl-base, libssh2-1t64 and libpcre2-8-0 upgraded in the SDK and API container images, patching high-severity Debian CVEs.
• PowerShell upgraded to 7.5.11 in the SDK and API container images, bundling .NET runtime 9.0.20 and patching CVE-2026-62901.
• anyio upgraded to 4.14.2 in the SDK, the API and the MCP Server, patching CVE-2026-63374.

See the full release notes on GitHub for the complete list of changes.

UI

🚀 Added

• Registry marketplace and external provider onboarding for Private Cloud, with permission-based access independent of billing, confirmed artifact installation, schema-driven credentials, connection checks, and scan launch (#12494)
• AWS Marketplace button variant with outlined styling for light and dark themes (#12803)
• UI_SELF_REGISTRATION_ENABLED flag for Prowler Private Cloud deployments; when "false", /sign-up only opens with an invitation, the sign-in page drops the "Sign up" link and the profile hides Create organization (#12815)
• "Invite your team" step offered once after the first provider is connected, before the onboarding checkpoint, reusing the invitation form tagged with source=onboarding (#12819)

🐞 Fixed

• Automatic onboarding stays hidden on billing pages and remains available after leaving billing (#12803)
• Per-provider breakdown and OCSF download for FedRAMP 20x KSI and Class C FRR in the cross-provider compliance view (#12810)
• Edit and Revoke actions are disabled for expired and revoked invitations (#12831)
• Cloudflare API token links in the provider wizard request the SSL and Certificates, Bot Management and Zone WAF read permissions the scan needs (#12842)

API

🐞 Fixed

• Report download URLs can be signed against a browser-reachable storage host via DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL, so downloads complete on deployments where storage is only reachable inside the container network (#12552)
• A scan report download no longer fails with a server error when DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION is unset, which is common on storage with no meaningful region (#12552)
• Lapsed pending invitations are reported as expired and no longer block a new invitation for the same email (#12831)

🔐 Security

• libsqlite3-0, gzip, perl-base and libpcre2-8-0 upgraded in the API container image, patching high Debian CVEs (#12804)
• PowerShell from 7.5.9 to 7.5.11 in the API container image, bundling .NET runtime 9.0.20 and patching CVE-2026-62901 (#12811)
• Bumped anyio to 4.14.2 to resolve CVE-2026-63374 (#12848)

SDK

🚀 Added

• FedRAMP-20x-KSI universal compliance framework (fedramp_20x_ksi_2026) with the 46 Key Security Indicators from the FedRAMP Consolidated Rules 2026 mapped for AWS, Azure, GCP, Kubernetes and M365 (#11701)
• smn_topic_subscriptions check for Huawei Cloud provider: SMN topics have at least one subscription configured (#12186)
• inspector2_coverage_scan_status_active, inspector2_coverage_recently_scanned, inspector2_active_findings_no_known_exploited_vulnerabilities, inspector2_active_findings_kev_within_due_date, inspector2_active_findings_within_max_age, elbv2_listener_fips_tls_enabled and transfer_server_fips_security_policy_enabled checks for AWS provider, covering FedRAMP 20x Class C vulnerability detection, CISA KEV remediation and FIPS cryptography rules; the KEV checks require inspector2:BatchGetFindingDetails, now in the Prowler additions policy (#12808)
• FedRAMP-20x-FRR-Class-C universal compliance framework (fedramp_20x_frr_class_c_2026) with the 158 provider rules of the FedRAMP 20x Class C ruleset from the FedRAMP Consolidated Rules 2026 for AWS, Azure, GCP, Kubernetes and M365 (#12808)

🔄 Changed

• FedRAMP 20x Phase One pilot frameworks fedramp_20x_ksi_low_aws, fedramp_20x_ksi_low_azure and fedramp_20x_ksi_low_gcp replaced by fedramp_20x_ksi_2026 (#12855)

🐞 Fixed

• security_2sv_enforced reports domain-wide 2-Step Verification failures as FAIL even when every failing setting is overridden for a group or organizational unit (#12700)
• Bootstrap STS calls now try up to two more regions of the partition declared in PROWLER_AWS_PARTITION when the first one cannot be reached, so a deployment that routes to only one region of its partition no longer fails on an endpoint it has no path to. This covers validating credentials, assuming a role and getting an MFA session token (#12799)
• KeyError in M365 Defender malware, anti-phishing and inbound anti-spam checks when the tenant has Standard or Strict preset security policies (#12809)
• Azure Defender security contacts and Key Vault key rotation policies now use the endpoints of the selected cloud (--azure-region) instead of the hardcoded management.azure.com and vault.azure.net hosts, so both work on AzureUSGovernment and AzureChinaCloud (#12813)

🔐 Security

• libsqlite3-0, gzip, perl-base, libssh2-1t64 and libpcre2-8-0 upgraded in the SDK container image, patching nine high Debian CVEs (#12804)
• PowerShell from 7.5.9 to 7.5.11 in the SDK container image, bundling .NET runtime 9.0.20 and patching CVE-2026-62901 (#12811)
• Bumped anyio to 4.14.2 to resolve CVE-2026-63374 (#12848)

MCP

🔐 Security

• Bumped anyio to 4.14.2 to resolve CVE-2026-63374 (#12848)