✨ New features to highlight in this version

Enjoy them all now for free at https://cloud.prowler.com/

🧭 Prowler Cloud — Issues Page

Prowler Cloud gets an Issues page and overview cards that group the findings of a scan into issues with a verdict, with verdict filters, accessible issue details and the finding evidence scoped to each issue.

🧠 AWS — Bedrock, Cognito and WAFv2 Checks

• bedrock_guardrail_sensitive_information_filter_enforced flags Bedrock guardrails whose PII entities or custom regexes take no action on the output path, so a detected match is reported in the trace and still delivered to the caller. Contributed by @tamg-aws. Thank you!
• bedrock_model_invocation_logging_text_data_enabled verifies that model invocation logging delivers prompt and response text instead of naming a destination while excluding request and response bodies. Contributed by @tamg-aws. Thank you!
• cognito_user_pool_account_recovery_sms_not_preferred verifies that Cognito user pools do not rank SMS first for account recovery. Contributed by @UTKARSH698. Thank you!
• wafv2_webacl_managed_rule_groups_enabled verifies that WAFv2 Web ACLs reference at least one managed rule group.

bedrock_api_key_no_long_term_credentials now reports Bedrock long-term API keys that never expire. IAM only returns ExpirationDate for keys created with an expiration period, so keys created without one were skipped and produced no finding at all.

🤖 GCP — Vertex AI Workbench Coverage

A new Vertex AI service audits the Workbench instances of each project with five checks, mapped to PCI DSS 4.0 and the CCC MLDE requirements, all contributed by @rajeshnadiminti. Thank you!

• vertexai_workbench_instance_public_ip_disabled and vertexai_workbench_instance_root_access_disabled cover how the instance can be reached and whether root access is available.
• vertexai_workbench_instance_terminal_access_disabled and vertexai_workbench_instance_file_download_disabled cover the terminal and file download features of JupyterLab.
• vertexai_workbench_instance_auto_upgrade_enabled verifies that the instance environment is upgraded automatically.

🐘 PHP2Shell — PHP Runtime Coverage

After the PHP2Shell security release (CVE-2026-109618, CVE-2026-109619), new checks flag the PHP runtimes without security fixes across providers.

• GCP: a new appengine service and the appengine_version_php_runtime_supported check flag App Engine serving versions on PHP runtimes without security fixes.
• AWS: elasticbeanstalk_environment_php_platform_updated flags Elastic Beanstalk PHP environments on branches without security fixes or on platform versions older than the one bundling the fixed PHP release, and lightsail_instance_php_blueprint_updated flags Lightsail instances created from PHP blueprints for manual verification of the PHP release.
• Azure: the default php_latest_version for app_ensure_php_version_is_latest is raised from 8.2 to 8.5, the newest PHP runtime on App Service for Linux, in both the SDK and the Prowler App scan configuration template. The App Service runtime checks (app_ensure_php_version_is_latest, app_ensure_python_version_is_latest, app_ensure_java_version_is_latest) now pass any runtime at or above the configured minimum instead of failing every version newer than the configured one.

Explore all checks at Prowler Hub.

📬 Google Workspace — Edition-Aware Findings and Policy Fixes

• Findings state when a feature is not sold on the tenant edition: Drive DLP rules, Google session control and the shared drive sharing settings on Business Starter. Reading editions needs the optional apps.licensing scope.
• Checks for Chat, Drive, Gmail, Calendar and Groups pass with the reason stated when the app is turned off for everyone and no organizational unit or group turns it back on. Drive sharing settings and the settings of existing groups keep being evaluated because existing shares and groups stay reachable.
• Checks now read the policy Google applies (greatest sortOrder) instead of the last policy the Cloud Identity Policy API lists, which reported default values over admin-configured ones.
• Gmail spoofing checks read each protection action from its own Policy API field; the inbound domain spoofing check could never pass and the similar domain names check reported the inbound action.
• drive_publishing_files_disabled passes when sharing outside the organization is limited to allowlisted domains or off, since publishing to the web only exists with sharing on.
• drive_desktop_access_disabled remediation steps now point to the Google Drive for desktop card in the Admin console.

🛠️ Improvements and Fixes

• "Launch an initial scan now" is ticked by default on the provider and organization setup launch steps, so saving a schedule also runs a first scan unless the box is unticked.
• Scan ingestion compares the serialized resource metadata with the stored value and serializes sets in a stable order, so unchanged resources no longer get their metadata, details and updated_at rewritten on every scan.
• Scan report generation parses each resource's metadata once per batch, sanitizes it once per finding and releases each batch before building the next one, so providers with very large resource metadata no longer exhaust the worker memory.
• Compliance report PDF cover table wraps every value, so long account IDs such as OCI tenancy OCIDs no longer overflow their cell.
• The SAML SSO integration card on the profile page is shown to roles with the Manage Account permission, matching the API requirement.

🔐 Security Updates

• GET /resources/metadata, GET /resources/metadata/latest, GET /findings/metadata and GET /findings/metadata/latest now honour the provider groups of the caller role instead of aggregating every provider in the tenant.
• Resource metadata attached to findings no longer carries the values that secrets checks scan (CloudFormation outputs, Lambda environment variables, EC2 user data and similar fields); they are replaced with REDACTED before reaching the Evidence tab, the API and the output files.
• Attack Paths custom queries strip block comments before the blocked-operation check and drop APOC virtual nodes and relationships from results, so LOAD CSV can no longer be split with a comment nor its response returned under a forged provider label.
• SAML SSO configuration endpoints require the manage_account permission instead of manage_integrations, since the configured IdP controls who signs in and which role they receive.
• OpenStack auth_url values resolving to loopback, private or otherwise non-public hosts are rejected before the SDK connects, on both the connection test and the scan.
• Node.js upgraded to 24.22.1 LTS in the UI container image, patching the eight CVEs of the October 2026 security release that affect the 24.x line, including the Brotli decoder remote code execution (CVE-2026-111497); the base image moves to Alpine 3.24.
• next upgraded to 16.4.1, @sentry/nextjs to 10.75.2 and dompurify to 3.4.17 in the UI, patching two unauthenticated remote code executions in Next.js (GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr), the Sentry middleware bypass through the tunnel route (GHSA-mchm-gjx6-7h55) and the DOMPurify SAFE_FOR_TEMPLATES bypass (GHSA-cg2g-xh64-v4q7).
• djangorestframework upgraded to 3.18.3 in the API, patching the JSON parser charset and Accept header denial of service and the TokenProxy revocation bypass.
• pillow upgraded to 13.0.0 in the API, patching the JPEG decoder heap overflow.
• certifi upgraded to 2026.10.19 in the SDK, the API and the MCP Server, and uv to 0.13.4 in the SDK and API container images, dropping the compromised emSign root CAs.
• aiohttp upgraded to 3.14.5 and yarl to 1.25.1 in the SDK and the API, patching the aiohttp resource exhaustion advisories.
• black upgraded to 26.10.1 and graphql-core to 3.2.12 in the SDK, and libbrotli1 to 1.1.0-2+deb13u1 in its container image.
• Trivy upgraded to 0.76.1 in the SDK and API container images, patching the HTTP/2, TLS and Go stdlib CVEs bundled in previous releases. The images no longer ship the MicrosoftTeams build SBOM that Trivy read as installed zod and body-parser.

🙌 External Contributors

Thank you to our community contributors for this release!

• @rajeshnadiminti: GCP Vertex AI service and its Workbench checks (#13062, #13077)
• @tamg-aws: AWS bedrock_guardrail_sensitive_information_filter_enforced and bedrock_model_invocation_logging_text_data_enabled checks and the bedrock_api_key_no_long_term_credentials fix (#12663)
• @UTKARSH698: AWS cognito_user_pool_account_recovery_sms_not_preferred check (#12251)

See the full release notes on GitHub for the complete list of changes.

UI

🚀 Added

• Issues page and overview cards for Cloud deployments, with verdict filters, accessible issue details, and scoped finding evidence (#13068)
• Outlined error badge variant with a visible border on error-colored surfaces (#13111)

🔄 Changed

• "Launch an initial scan now" is ticked by default on the provider and organization setup launch steps, so saving a schedule also runs a first scan unless the box is unticked (#13104)
• SAML SSO integration card on the profile page is shown to roles with the Manage Account permission, matching the API requirement (#13121)
• Default php_latest_version in the scan configuration template raised from 8.2 to 8.5 (#13128)

🔐 Security

• Node.js from 24.18.1 to 24.22.1 LTS in the UI container image and .nvmrc, patching the eight CVEs of the October 2026 security release that affect the 24.x line, including the Brotli decoder remote code execution (CVE-2026-111497); the base image moves to Alpine 3.24, so the targeted libcrypto3 / libssl3 upgrade is no longer needed (#13126)
• Next.js from 16.3.8 to 16.4.1, @sentry/nextjs from 10.65.0 to 10.75.2 and the transitive DOMPurify pin to 3.4.17, closing four critical advisories: two unauthenticated remote code executions in Next.js (Image Optimization with SVG files, GHSA-2464-fhr4-w9xw; use cache functions returning typed arrays, GHSA-673q-mjm6-r5xr), the Sentry middleware bypass through the tunnel route (GHSA-mchm-gjx6-7h55) and the DOMPurify SAFE_FOR_TEMPLATES bypass (GHSA-cg2g-xh64-v4q7) (#13135)

API

🐞 Fixed

• Compliance report PDF cover table wraps every value, so long account IDs such as OCI tenancy OCIDs no longer overflow their cell (#13063)
• Scan ingestion compares the serialized resource metadata with the stored value and serializes sets in a stable order, so unchanged resources no longer get their metadata, details and updated_at rewritten on every scan (#13148)
• Report generation shares the parsed resource metadata between the findings of a batch and releases each batch before building the next one (#13149)

🔐 Security

• GET /resources/metadata, GET /resources/metadata/latest, GET /findings/metadata and GET /findings/metadata/latest now honour the provider groups of the caller role instead of aggregating every provider in the tenant (#12964)
• Trivy from 0.75.0 to 0.76.0 in the API container image, built with Go 1.27.2 and x/net 0.60.0, patching the HTTP/2 and TLS CVEs bundled in Trivy 0.75.0 (#13064)
• Pillow from 12.3.0 to 13.0.0, certifi to 2026.10.19, aiohttp to 3.14.5 with yarl 1.25.1, uv to 0.13.4 and Trivy to 0.76.1 in the API container image, patching the Pillow JPEG decoder heap overflow, the compromised emSign root CAs bundled in certifi and uv, the aiohttp resource exhaustion advisories and the Go 1.27.2 stdlib CVE in the Trivy binary (#13107)
• Attack Paths custom queries strip block comments before the blocked-operation check and drop APOC virtual nodes and relationships from results, so LOAD CSV can no longer be split with a comment nor its response returned under a forged provider label (#13120)
• SAML SSO configuration endpoints require the manage_account permission instead of manage_integrations, since the configured IdP controls who signs in and which role they receive (#13121)
• djangorestframework from 3.15.2 to 3.18.3 in the API, patching the JSON parser charset and Accept header denial of service and the TokenProxy revocation bypass, and the API container image no longer ships the MicrosoftTeams build SBOM that Trivy read as installed zod and body-parser (#13157)

SDK

🚀 Added

• cognito_user_pool_account_recovery_sms_not_preferred check verifying Cognito user pools do not rank SMS first for account recovery (#12251)
• bedrock_guardrail_sensitive_information_filter_enforced check for AWS provider, flagging Bedrock guardrails whose PII entities or custom regexes take no action on the output path, so a detected match is reported in the trace and still delivered to the caller (#12663)
• bedrock_model_invocation_logging_text_data_enabled check for AWS provider, verifying that model invocation logging delivers prompt and response text rather than naming a destination while excluding request and response bodies (#12663)
• Vertex AI service for GCP provider, including the vertexai_workbench_instance_public_ip_disabled and vertexai_workbench_instance_root_access_disabled checks mapped to PCI DSS 4.0 (#13062)
• vertexai_workbench_instance_terminal_access_disabled, vertexai_workbench_instance_file_download_disabled and vertexai_workbench_instance_auto_upgrade_enabled checks for GCP provider, with Vertex AI Workbench checks mapped to CCC MLDE requirements (#13077)
• Google Workspace findings state when a feature is not sold on the tenant edition: Drive DLP rules, Google session control and the shared drive sharing settings on Business Starter; reading editions needs the optional apps.licensing scope (#13113)
• wafv2_webacl_managed_rule_groups_enabled check to verify WAFv2 Web ACLs reference at least one managed rule group (#13127)
• appengine GCP service and appengine_version_php_runtime_supported check to flag App Engine serving versions on PHP runtimes without security fixes (#13127)
• elasticbeanstalk_environment_php_platform_updated check to flag Elastic Beanstalk PHP environments on branches without security fixes or on platform versions older than the one bundling the fixed PHP release (#13127)
• lightsail_instance_php_blueprint_updated check to flag Lightsail instances created from PHP blueprints for manual verification of the PHP release (#13127)

🔄 Changed

• Google Workspace checks for Chat, Drive, Gmail, Calendar and Groups pass with the reason stated when the app is turned off for everyone and no organizational unit or group turns it back on. The rule covers settings that only act while the app is on: Drive sharing settings and the settings of existing groups keep being evaluated because existing shares and groups stay reachable, and only group creation is exempt when Groups for Business is off (#13117)
• Default php_latest_version for app_ensure_php_version_is_latest raised from 8.2 to 8.5, the newest PHP runtime on Azure App Service for Linux, following the PHP2Shell (CVE-2026-109618, CVE-2026-109619) security release (#13128)

🐞 Fixed

• bedrock_api_key_no_long_term_credentials now reports a Bedrock long-term API key that never expires; IAM only returns ExpirationDate for keys created with an expiration period, so keys created without one were skipped and produced no finding at all (#12663)
• drive_desktop_access_disabled remediation steps for Google Workspace now point to the Google Drive for desktop card in the Admin console instead of Features and Applications (#13113)
• Gmail spoofing checks read each protection action from its own Policy API field; the inbound domain spoofing check could never pass and the similar domain names check reported the inbound action (#13114)
• Google Workspace drive_publishing_files_disabled passes when sharing outside the organization is limited to allowlisted domains or off, since publishing to the web only exists with sharing on (#13115)
• Google Workspace checks now read the policy Google applies (greatest sortOrder) instead of the last policy the Cloud Identity Policy API lists, which reported default values over admin-configured ones (#13117)
• Azure App Service runtime checks (app_ensure_php_version_is_latest, app_ensure_python_version_is_latest, app_ensure_java_version_is_latest) now pass any runtime at or above the configured minimum instead of failing every version newer than the configured one (#13127)
• Scan report generation parses each resource's metadata once per batch and sanitizes it once per finding, so providers with very large resource metadata no longer exhaust the worker memory (#13149)

🔐 Security

• OpenStack auth_url resolving to loopback, private or otherwise non-public hosts rejected before the SDK connects, on both the connection test and the scan (#12962)
• Trivy from 0.75.0 to 0.76.0 in the SDK container image, built with Go 1.27.2 and x/net 0.60.0, patching the HTTP/2 and TLS CVEs bundled in Trivy 0.75.0 (#13064)
• certifi to 2026.10.19 and aiohttp to 3.14.5 with yarl 1.25.1 in the SDK, plus uv 0.13.4 and Trivy 0.76.1 in its container image, patching the compromised emSign root CAs bundled in certifi and uv, the aiohttp resource exhaustion advisories and the Go 1.27.2 stdlib CVE in the Trivy binary (#13107)
• Resource metadata attached to findings no longer carries the values that secrets checks scan (CloudFormation outputs, Lambda environment variables, EC2 user data and similar fields); they are replaced with REDACTED before reaching the Evidence tab, the API and the output files (#13129)
• black from 26.3.1 to 26.10.1 and graphql-core from 3.2.8 to 3.2.12 in the SDK, and libbrotli1 1.1.0-2+deb13u1 in its container image, which no longer ships the MicrosoftTeams build SBOM that Trivy read as installed zod and body-parser (#13135)

MCP

🔐 Security

• certifi from 2026.4.22 to 2026.10.19 in the MCP Server container image, dropping the emSign root CAs whose intermediate keys were compromised (#13107)