✨ New features to highlight in this version

Enjoy them all now for free at https://cloud.prowler.com/

🤖 Azure — AI Services Coverage

A new Azure AI Services service audits the Azure AI and Azure OpenAI accounts of each subscription, with nine checks across network exposure, authentication, encryption, identity, logging and content safety, all contributed by @rajeshnadiminti. Thank you!

• aiservices_account_public_network_access_disabled, aiservices_account_network_acls_default_action_deny, aiservices_account_uses_private_endpoint and aiservices_account_outbound_network_restricted cover how the account can be reached and what it can reach.
• aiservices_account_local_auth_disabled and aiservices_account_managed_identity_enabled cover key-based access and the account's own identity.
• aiservices_account_encrypted_with_cmk and aiservices_account_diagnostic_logging_enabled cover customer-managed key encryption and diagnostic logs.
• aiservices_deployment_content_filter_prompt_shield_enabled verifies that model deployments have Prompt Shields enabled in their content filter.

🪪 Microsoft 365 — New Entra ID Checks

Five new Entra ID checks, all contributed by @kinomakino. Thank you!

• entra_cross_tenant_access_default_outbound_restricted verifies that the default cross-tenant access policy does not let every user reach every external application through B2B collaboration or B2B direct connect.
• entra_policy_admin_self_service_password_reset_disabled verifies that Self-Service Password Reset is disabled for administrators.
• entra_policy_msol_powershell_blocked verifies that the tenant authorization policy blocks the legacy MSOnline PowerShell module.
• entra_app_registration_redirect_uris_secure flags app registrations with HTTP, wildcard, malformed or azurewebsites.net redirect URIs.
• entra_dynamic_group_member_of_rule_not_used flags dynamic groups whose membership rule uses the memberOf operator, which Microsoft retires on November 3, 2026.

Explore all checks at Prowler Hub.

☁️ OCI — Connect Tenancies Outside us-ashburn-1

OCI API key credentials now take a home region, and the credentials form in Prowler App requires it. Identity calls that validate the credentials and discover the subscribed regions used to go to us-ashburn-1 regardless of the tenancy, so a tenancy not subscribed to that region could not connect. The home region is only used for that bootstrap; scans still audit every subscribed region.

Read more in the Getting Started with OCI documentation.

🛠️ Improvements and Fixes

• AWS: Organizations metadata is fetched from the partition of the audited account, using the region that answered the STS bootstrap, instead of the commercial us-east-1 endpoint, which timed out in GovCloud.
• API Gunicorn workers are recycled after 10,000 requests, plus up to 1,000 of jitter, to cap memory growth. Both values are configurable with GUNICORN_MAX_REQUESTS and GUNICORN_MAX_REQUESTS_JITTER.
• The first-login redirect to the Add Provider wizard is retried on the next load when the navigation was cut short, instead of being written off after a single attempt.
• The AWS connect step offers to invite a teammate when the user cannot access the account credentials.
• Prowler Cloud: the Slack channel picker reads the channels the Prowler app is in before the public ones, so invited private channels show up in large workspaces, and the partial list message tells the user to invite the app to a missing channel.

🔐 Security Updates

• Kubernetes kubeconfigs accept only inline credentials and known cluster fields. File-path fields, command-based authentication, auth-provider directives, proxy URLs and unknown keys are rejected by the API and the credentials form, and stored kubeconfigs are re-validated before each scan and connection test.
• IaC repository URLs that resolve to loopback, private or otherwise non-public hosts are rejected before the connection test and the scan clone, including every destination a redirect points to.
• CSV outputs prefix cells starting with =, +, -, @, tab or carriage return with a single quote so spreadsheet applications treat them as text, and the HTML report escapes the compliance column.
• GET /api/v1/users/{id} no longer exposes another user's memberships, roles or tenant names from tenants other than the one in the request token.
• API error reports sent to Sentry no longer include user identity, IP addresses, cookies, headers or request bodies.
• PowerShell upgraded to 7.5.12 in the SDK and API container images, bundling .NET runtime 9.0.21.
• Python base images upgraded to 3.12.15 in the SDK and API and to 3.13.16 in the MCP Server, and Trivy to 0.75.0, patching CVE-2026-19445, CVE-2026-19553 and the grpc-go and x/crypto CVEs bundled in Trivy.
• django upgraded to 5.2.17 in the API, patching CVE-2026-15307.
• pyjwt upgraded to 2.14.0 in the SDK, the API and the MCP Server, patching GHSA-ffc3-869f-jxw9.
• pymongo upgraded to 4.18.2 and urllib3 to 2.8.0 in the SDK and the API, patching CVE-2026-96748, CVE-2026-96749, CVE-2026-97687 and CVE-2026-97689.
• dulwich upgraded to 1.2.9 in the SDK and the API, patching GHSA-5fqc-mrg8-w798, GHSA-8mcx-5rqc-vhmf, GHSA-8w8g-wq8h-fq33 and GHSA-cm62-gvxx-vmxx.
• next upgraded to 16.3.8 in the UI, patching a remote code execution in next/og (GHSA-vcvr-r3jv-pc5j) and a server-side request forgery in Image Optimization (GHSA-cjq9-62q9-8jv4).
• sharp upgraded to 0.35.5 and proxy-addr to 2.0.8 in the UI, patching GHSA-wq5f-xc86-pv6w and GHSA-jqcg-44mw-7w3h.

🙌 External Contributors

Thank you to our community contributors for this release!

• @rajeshnadiminti: Azure AI Services service and its checks (#12925, #12926, #12997)
• @kinomakino: Microsoft 365 entra_cross_tenant_access_default_outbound_restricted (#12991), entra_policy_admin_self_service_password_reset_disabled (#12990), entra_policy_msol_powershell_blocked (#13004), entra_app_registration_redirect_uris_secure (#12993) and entra_dynamic_group_member_of_rule_not_used (#13003) checks

See the full release notes on GitHub for the complete list of changes.

UI

🚀 Added

• Option to invite a teammate from the AWS connect step when the user cannot access the account credentials (#12917)

🐞 Fixed

• Required home region selector in the OCI credentials form, so tenancies not subscribed to us-ashburn-1 can connect (#12865)
• First-login redirect to the add-provider wizard is retried on the next load when the navigation was cut short, on Cloud and self-hosted alike, instead of being written off after a single attempt (#12914)
• Slack partial channel list message tells the user to invite the app to a missing channel (#13036)
• Registry provider discovery distinguishes paid-plan upgrades, missing credentials, and connection failures (#13038)

🔐 Security

• next to 16.3.6, patching a remote code execution in next/og ImageResponse (GHSA-vcvr-r3jv-pc5j) (#12922)
• Kubernetes kubeconfig form validation accepts only inline credentials and known cluster fields, rejecting file-path, command-based, auth-provider, proxy URL and unknown fields before submission (#12952)
• proxy-addr to 2.0.8, patching IP spoofing through IPv4-mapped IPv6 trust subnets (GHSA-jqcg-44mw-7w3h) (#12957)
• sharp to 0.35.5, patching a librsvg memory vulnerability that can lead to remote code execution on glibc-based Linux (GHSA-wq5f-xc86-pv6w) (#12968)
• next to 16.3.8, patching a server-side request forgery in Image Optimization (GHSA-cjq9-62q9-8jv4) (#12987)

API

🐞 Fixed

• OCI provider secrets keep the region as home region for credential validation and scans, instead of always using us-ashburn-1 (#12865)
• Gunicorn workers are now recycled after 10000 requests (plus up to 1000 of jitter) to cap memory growth, configurable with GUNICORN_MAX_REQUESTS and GUNICORN_MAX_REQUESTS_JITTER (#13047)

🔐 Security

• pyjwt from 2.13.0 to 2.14.0, patching GHSA-ffc3-869f-jxw9 (#12911)
• Sentry error events no longer include user identity, IP addresses, cookies, headers or request bodies, which could contain personal data or provider credentials (#12912)
• Kubernetes kubeconfig validation accepts only inline credentials and known cluster fields, rejecting file-path fields (tokenFile, client-certificate, client-key, certificate-authority), command-based authentication (exec, cmd-path), auth-provider directives, proxy URLs and unknown user or cluster keys; stored kubeconfigs are re-validated before each scan and connection test (#12952)
• django from 5.1.15 to 5.2.17, patching CVE-2026-15307 (#12953)
• dulwich from 1.2.5 to 1.2.9, patching GHSA-5fqc-mrg8-w798, GHSA-8mcx-5rqc-vhmf, GHSA-8w8g-wq8h-fq33 and GHSA-cm62-gvxx-vmxx (#12953)
• urllib3 from 2.7.0 to 2.8.0, patching CVE-2026-97687 and CVE-2026-97689 (#12953)
• pymongo from 4.15.1 to 4.18.2, patching CVE-2026-96748 and CVE-2026-96749 (#12955)
• GET /api/v1/users/{id} no longer exposes another user's memberships, roles or tenant names from tenants other than the one in the request token (#12965)
• Python base image from 3.12.13 to 3.12.15 and Trivy from 0.74.0 to 0.75.0 in the API container image, patching CVE-2026-19445, CVE-2026-19553 and the grpc-go and x/crypto CVEs bundled in Trivy (#13009)
• PowerShell from 7.5.11 to 7.5.12 in the API container image, bundling .NET runtime 9.0.21 (#13037)

SDK

🚀 Added

• Azure AI Services service for Azure provider, including the aiservices_account_public_network_access_disabled, aiservices_account_local_auth_disabled, and aiservices_account_encrypted_with_cmk checks (#12925)
• aiservices_account_uses_private_endpoint, aiservices_account_outbound_network_restricted, aiservices_account_managed_identity_enabled, and aiservices_account_diagnostic_logging_enabled checks for Azure provider (#12926)
• entra_policy_admin_self_service_password_reset_disabled check for M365 provider, verifying that Self-Service Password Reset is disabled for administrators (#12990)
• entra_cross_tenant_access_default_outbound_restricted check for M365 provider, verifying that default cross-tenant access does not let all users reach all external applications through B2B collaboration or B2B direct connect (#12991)
• entra_app_registration_redirect_uris_secure check for M365 provider, flagging app registrations with HTTP, wildcard, malformed or azurewebsites.net redirect URIs (#12993)
• aiservices_account_network_acls_default_action_deny and aiservices_deployment_content_filter_prompt_shield_enabled checks for Azure provider (#12997)
• entra_dynamic_group_member_of_rule_not_used check for M365 provider, flagging dynamic groups whose membership rule uses the memberOf operator that Microsoft retires on November 3, 2026 (#13003)
• entra_policy_msol_powershell_blocked check for M365 provider, verifying that the tenant authorization policy blocks the legacy MSOnline PowerShell module (#13004)

🐞 Fixed

• OCI API key credentials accept a home region to bootstrap identity calls, so tenancies not subscribed to us-ashburn-1 can connect (#12865)
• AWS Organizations metadata is fetched from the partition of the audited account, using the region that answered the STS bootstrap, instead of the commercial us-east-1 endpoint a session without a region resolves to, which timed out in GovCloud (#12988)

🔐 Security

• pyjwt from 2.13.0 to 2.14.0, patching GHSA-ffc3-869f-jxw9 (#12911)
• dulwich from 1.2.5 to 1.2.9, patching GHSA-5fqc-mrg8-w798, GHSA-8mcx-5rqc-vhmf, GHSA-8w8g-wq8h-fq33 and GHSA-cm62-gvxx-vmxx (#12953)
• urllib3 from 2.7.0 to 2.8.0, patching CVE-2026-97687 and CVE-2026-97689 (#12953)
• pymongo from 4.15.1 to 4.18.2, patching CVE-2026-96748 and CVE-2026-96749 (#12955)
• IaC repository URLs resolving to loopback, private or otherwise non-public hosts rejected before both the connection test and the scan clone, including every destination a redirect points to, with raw errors no longer echoed to the caller or the logs (#12960)
• HTML report compliance column is now escaped, so framework names and requirement IDs containing markup are shown as text instead of being rendered by the browser (#12963)
• CSV outputs (findings, compliance and AWS quick inventory) prefix cells starting with =, +, -, @, tab or carriage return with a single quote so spreadsheet applications treat them as text instead of formulas; signed numbers such as -1 are left untouched (#12963)
• Python base image from 3.12.13 to 3.12.15 and Trivy from 0.74.0 to 0.75.0 in the SDK container image, patching CVE-2026-19445, CVE-2026-19553 and the grpc-go and x/crypto CVEs bundled in Trivy (#13009)
• PowerShell from 7.5.11 to 7.5.12 in the SDK container image, bundling .NET runtime 9.0.21 (#13037)

MCP

🔐 Security

• pyjwt from 2.13.0 to 2.14.0, patching GHSA-ffc3-869f-jxw9 (#12911)
• Python from 3.13.14 to 3.13.16 in the MCP container image, patching CVE-2026-19445 and CVE-2026-19553 (#13009)