✨ New features to highlight in this version

Enjoy them all now for free at https://cloud.prowler.com/

⚡ Prowler Cloud — Realtime Detection and Remediation for AWS

A scan tells you what was wrong at the time it ran. Prowler Realtime watches an AWS account's CloudTrail as events happen, checks each risky call with a targeted Prowler check on the resource it touched, and responds the way the account's policy says, minutes after the change instead of at the next scan.

• Events arrive from an EventBridge to SQS feed, deployed with the CloudFormation or Terraform templates, or from a CloudTrail LookupEvents fallback.
• Each account has a policy mode: monitor alerts, pr proposes the change as a Terraform pull request behind a security gate, and auto fixes the resource through an optional remediation-only role, with every action recorded and reversible. Auto-fix can run as a dry run first.
• The /realtime dashboard has an overview with posture, open violations and verified fixes, plus Detections, Remediation with revert, a live Event stream, Prioritized findings and opt-in Cost anomalies. Details open in the side panel next to Lighthouse AI, and one Configuration page covers the event feed, enforced frameworks, remediation access, alerts and activation.
• Accounts show labelled demo data until Realtime is set up, and the status can be shared as a redacted statement to copy or download.
• A new "Manage Realtime" role permission controls who can change the policy; reading stays open to roles that can see the provider. Lighthouse AI and the MCP Server get Realtime tools to manage the policy and feed, read detections and actions, and revert them.

🎯 Prowler Cloud — Issues From the Side Panel

• The issue side panel now holds everything the full issue page had, and the page is gone: "Findings" and "Resources" tabs, the evidence lines of each leg, the compliance frameworks under the title and "Send to Jira" in the header menu. A finding clicked in the attack path or the Findings tab opens inside the panel, with a breadcrumb back.
• A "Contextual Fix" Lighthouse AI skill on the issue panel reads the open legs and the findings of the path, leads with the single change that closes it fastest and then lists per-resource fixes grouped by check.
• Issues with dozens of findings load their attack path, findings and resources again; the panel used to send every finding UID from the browser and larger issues were rejected.

🚀 First Scan — Findings and Sample Data While You Wait

• Scans run checks from the highest to the lowest severity, so critical and high findings are stored first. While a tenant's first scan is running, the Findings page shows its findings as they arrive with a progress banner, and executing scans get a "View Early Findings" action.
• Finding groups show the check title instead of the check ID during a tenant's first scan.
• Prowler Cloud: until the first scan completes, Overview, Findings, Resources, Compliance, Issues and Attack Paths show labelled sample data from a demo AWS account, with a banner that follows the real scan and swaps the sample out when it finishes.

🤖 AWS — Bedrock AgentCore Coverage

A new bedrockagentcore service collects AgentCore gateways, gateway targets, agent runtimes, memories, browsers, code interpreters and token vaults, with three new checks in the service and one in CloudTrail:

• bedrockagentcore_full_access_policy_attached flags IAM roles with the AgentCore full access managed policies, and bedrockagentcore_payments_process_payment_role_separation flags roles allowed both CreatePaymentSession and ProcessPayment. Contributed by @tamg-aws. Thank you!
• cloudtrail_agentcore_data_events_enabled verifies that actively logging trails record AgentCore data events for every AgentCore resource type in use. Contributed by @tamg-aws. Thank you!
• bedrockagentcore_runtime_vpc_configured verifies that AgentCore runtimes use VPC network mode. Contributed by @Nithin078. Thank you!

☁️ Cloudflare, GitHub and Vercel Checks

• Cloudflare: new account service with account_two_factor_enforced, account_member_two_factor_enabled, account_super_admins_limited, account_api_token_expiration_set, account_api_token_ip_restriction_enabled and account_api_token_recently_used; new r2 service with r2_bucket_public_dev_url_disabled, r2_bucket_cors_no_wildcard_origin and r2_bucket_custom_domain_min_tls_secure; new workers service with workers_script_observability_enabled, workers_script_workers_dev_disabled, workers_script_preview_urls_disabled and workers_script_no_secrets_in_plain_text_bindings; and zone_firewall_no_skip_all_traffic_rules, which flags enabled skip rules that match all traffic and bypass the managed WAF or rate limiting.
• GitHub: repository_secret_scanning_push_protection_enabled flags repositories that accept pushes containing secrets.
• Vercel: project_environment_no_secrets_with_public_prefix flags secret-like environment variables that frontend frameworks inline into the browser bundle through prefixes such as NEXT_PUBLIC_ or VITE_, and project_linked_to_git_repository flags projects that can only receive unreviewed CLI deployments.

Explore all checks at Prowler Hub.

📋 Compliance

• GDPR for Azure, mapping Articles 25, 30 and 32 to existing Azure checks. Contributed by @m-khan-97. Thank you!
• Cloudflare mappings for NCSC Cyber Essentials 3.3. Contributed by @ethanhawkes-gif. Thank you!
• The NATO D32 compliance icon uses the official NATO/OTAN logo.

🏢 Prowler Private Cloud on AWS Marketplace

Prowler Private Cloud is listed on AWS Marketplace as Pay as You Go and 10 and 25 account bundles, installed in the customer's own AWS account and billed on the AWS bill. Marketplace installations report scanned accounts hourly, send a monthly usage statement and show a sidebar notice when the subscription is ending or paused; Lighthouse AI uses OpenAI gpt-oss-120b on Amazon Bedrock with the installation's own role. See Prowler Private Cloud for plans and installation.

🛠️ Improvements and Fixes

• The OSS CLI HTML report, prowler dashboard and its terminal output show a short note on bringing findings to Prowler Cloud. Nothing is uploaded, and PROWLER_NO_PROMOTIONS=1 turns the dashboard note off; Prowler Cloud and Private Cloud reports never include it.
• WAFv2 ListWebACLs is paginated, so accounts with more than one page of Web ACLs are fully scanned, and CloudFront Web ACL rules, logging and tags are read even when the scan excludes us-east-1. Contributed by @tamg-aws. Thank you!
• CloudTrail trail status and event selectors are read per trail, so one unreadable trail no longer leaves the others unread.
• vpc_endpoint_connections_trust_boundaries skips VPC endpoints whose service does not support endpoint policies, such as Amazon SES SMTP, instead of failing them. Contributed by @jvgiorgi12. Thank you!
• guardduty_ai_protection_enabled and iam_user_access_not_stale_to_sagemaker join the gen-ai category.
• zone_challenge_passage_configured reports Cloudflare zones without a challenge passage TTL as non-compliant.
• MongoDB Atlas connection errors include the HTTP status, error code and detail Atlas returns instead of a generic HTTP error.
• Findings partitions tile exactly, so findings no longer land in the default partition at each window boundary and miss the age-out. Contributed by @AlexeyShalaev. Thank you!
• The cross-provider compliance view shows the per-provider breakdown for frameworks without a dedicated UI mapper.
• The Overview cards fit every screen width and no longer stack into a single column on narrower screens.
• Prowler Cloud: Lighthouse AI settings accept a Bedrock API key as an alternative to AWS access keys.

🔐 Security Updates

• POST /api/v1/tokens/github and POST /api/v1/tokens/google only accept an OAuth authorization code and reject caller-supplied access_token and id_token values, which could have been issued to another OAuth client. Reported by @Mrcyberwarri0r. Thank you!
• GCP service_account credentials must be of type service_account with a Google token_uri, in the SDK and in provider secrets, rejecting external_account configurations and custom token endpoints that could read local files or reach internal URLs. Reported by @Mrcyberwarri0r.
• Python base image upgraded to 3.12.16 in the SDK and API images and 3.13.18 in the MCP Server image, patching CVE-2026-115557.
• PowerShell upgraded to 7.5.13 in the SDK and API images, bundling .NET runtime 9.0.22, and apt to 3.0.4.
• oauthlib upgraded to 4.0.1 in the SDK and API images, patching the OAuth device flow bearer token disclosure.
• pyasn1 upgraded to 0.6.5 in the SDK and the API and joserfc to 1.7.5 in the SDK and the MCP Server, patching the ASN.1 decoding and JWE decryption denial of service advisories.
• h2 upgraded to 4.4.1 and werkzeug to 3.1.9 in the SDK and the API, patching the duplicate Host header request smuggling and the Windows device name bypass in safe_join.
• fastmcp upgraded to 3.4.10 in the MCP Server, patching the skipped authorization check on direct calls to transformed components.
• zod, js-yaml, vitest and transitive UI dependencies upgraded to patched versions, resolving 33 npm audit advisories.

🙌 External Contributors

Thank you to our community contributors for this release!

• @tamg-aws: AWS Bedrock AgentCore inventory, IAM role separation and CloudTrail data event checks, and the WAFv2 pagination and CloudFront fixes (#12557, #12558, #12563, #12658)
• @Nithin078: AWS bedrockagentcore_runtime_vpc_configured check (#12800)
• @m-khan-97: GDPR compliance framework for Azure (#11590)
• @ethanhawkes-gif: Cyber Essentials 3.3 mappings for Cloudflare (#12641)
• @jvgiorgi12: VPC endpoint policy support fix (#13169)
• @AlexeyShalaev: findings partition bounds fix (#12766)

See the full release notes on GitHub for the complete list of changes.

UI

🚀 Added

• Findings page shows the findings of a running first scan as they arrive, plus a "View Early Findings" action on executing scans (#13255)

🔄 Changed

• NATO D32 compliance icon now uses the official NATO/OTAN logo (#13278)

🐞 Fixed

• Cross-provider compliance view shows the per-provider breakdown for frameworks without a dedicated UI mapper instead of "No per-provider breakdown is available" (#13261)

🔐 Security

• zod to 4.6.6, js-yaml to 4.3.2 and vitest to 4.1.11, plus transitive hono, vite, brace-expansion, fast-uri, ip-address, body-parser, qs and baseline-browser-mapping to patched versions, resolving 33 npm audit advisories (9 high, 21 moderate, 3 low) (#13249)

API

🔄 Changed

• jsonschema 4.26.0 for SDK schema validation, picked up through the SDK dependency (#13274)

🐞 Fixed

• Findings partitions now tile exactly instead of leaving a sub-millisecond gap at each window boundary, where findings landed in the default partition and were never aged out (#12766)
• Finding groups show the check title instead of the check ID while a tenant's first scan is running (#13255)

🔐 Security

• Python base image from 3.12.15 to 3.12.16 in the API container image, patching CVE-2026-115557 (#13215)
• pyasn1 to 0.6.5, patching the ASN.1 decoding denial of service advisories (#13247)
• PowerShell from 7.5.12 to 7.5.13 in the API container image, bundling .NET runtime 9.0.22 (#13253)
• h2 from 4.3.0 to 4.4.1 and werkzeug from 3.1.7 to 3.1.9, patching the duplicate Host header request smuggling and the Windows device name bypass in safe_join, plus pylint 4.0.9 and filelock 4.2.1 in the development dependencies (#13257)
• POST /api/v1/tokens/github and POST /api/v1/tokens/google only accept an OAuth authorization code, rejecting caller-supplied access_token and id_token values issued to other OAuth clients (#13263)
• oauthlib from 4.0.0 to 4.0.1 in the API container image, patching the OAuth device flow bearer token disclosure (#13263)
• GCP service_account provider secrets require a key with "type": "service_account" and a Google token_uri, rejecting external_account and other credential types or custom token endpoints that could read worker files or reach internal URLs (#13263)
• apt and libapt-pkg7.0 3.0.4 in the API container image (#13268)

SDK

🚀 Added

• GDPR compliance framework for Azure provider, mapping Articles 25, 30 and 32 to existing Azure checks (#11590)
• bedrockagentcore service for AWS provider, collecting AgentCore gateways, gateway targets, agent runtimes, memories, browsers, code interpreters and token vaults (#12557)
• bedrockagentcore_full_access_policy_attached and bedrockagentcore_payments_process_payment_role_separation checks for AWS provider, flagging IAM roles with the AgentCore full access managed policies or allowed both CreatePaymentSession and ProcessPayment (#12558)
• cloudtrail_agentcore_data_events_enabled check for AWS provider, verifying that actively logging trails record Amazon Bedrock AgentCore data events for every AgentCore resource type in use (#12563)
• Cloudflare check mappings for the NCSC Cyber Essentials 3.3 compliance framework (#12641)
• bedrockagentcore_runtime_vpc_configured check for AWS provider, verifying that Amazon Bedrock AgentCore runtimes use VPC network mode (#12800)
• repository_secret_scanning_push_protection_enabled check for GitHub to flag repositories that accept pushes containing secrets because secret scanning push protection is disabled (#13138)
• project_environment_no_secrets_with_public_prefix check for Vercel to flag secret-like environment variables that frontend frameworks inline into the browser bundle through public prefixes such as NEXT_PUBLIC_ or VITE_ (#13139)
• project_linked_to_git_repository check for Vercel to flag projects that are not linked to a Git repository and can only receive unreviewed CLI deployments (#13139)
• Prowler Cloud hand-off block after the assessment summary in OSS CLI HTML reports, controlled by an opt-in show_cloud_cta option that Prowler Cloud and Private Cloud exports leave disabled (#13221)
• zone_firewall_no_skip_all_traffic_rules check for Cloudflare provider, flagging enabled firewall skip rules that match all traffic and bypass managed WAF, rate limiting or other security features (#13237)
• r2 service for Cloudflare provider with r2_bucket_public_dev_url_disabled, r2_bucket_cors_no_wildcard_origin and r2_bucket_custom_domain_min_tls_secure checks (#13237)
• workers service for Cloudflare provider with workers_script_observability_enabled, workers_script_workers_dev_disabled, workers_script_preview_urls_disabled and workers_script_no_secrets_in_plain_text_bindings checks for Workers scripts (#13237)
• account service for Cloudflare provider with account_two_factor_enforced, account_member_two_factor_enabled, account_super_admins_limited, account_api_token_expiration_set, account_api_token_ip_restriction_enabled and account_api_token_recently_used checks (#13237)

🔄 Changed

• prowler dashboard startup output now shows the Local Dashboard logo, the CSV directory, a brief Prowler Cloud hand-off block that PROWLER_NO_PROMOTIONS=1 disables, and the local URL once the server is listening (#13221)
• Scans run checks from highest to lowest severity, so critical and high findings are stored first (#13255)
• jsonschema 4.26.0 for mutelist and custom checks metadata validation (#13274)

🐞 Fixed

• CloudTrail trail status and event selectors are now read per trail, so one unreadable trail no longer leaves the remaining trails unread (#12563)
• WAFv2 CloudFront Web ACL rules, logging configuration and tags, so scans that exclude us-east-1 no longer report those Web ACLs as having no rules (#12658)
• WAFv2 ListWebACLs pagination, so scans of accounts with more than one page of Web ACLs no longer stop at the first page (#12658)
• Zones without a challenge passage TTL are reported as non-compliant by zone_challenge_passage_configured (#12693)
• vpc_endpoint_connections_trust_boundaries now skips VPC endpoints whose service AWS reports as not supporting endpoint policies (VpcEndpointPolicySupported), instead of failing endpoints like Amazon SES SMTP whose default policy cannot be changed (#13169)
• MongoDB Atlas connection errors now include the HTTP status, error code and detail returned by Atlas instead of a generic HTTP error, and a custom exception message no longer persists into later errors of the same type (#13214)
• gen-ai category for guardduty_ai_protection_enabled and iam_user_access_not_stale_to_sagemaker AWS checks (#13246)

🔐 Security

• Python base image from 3.12.15 to 3.12.16 in the SDK container image, patching CVE-2026-115557 (#13215)
• pyasn1 to 0.6.5 and joserfc to 1.7.5 in the SDK, patching the ASN.1 decoding and JWE decryption denial of service advisories (#13247)
• PowerShell from 7.5.12 to 7.5.13 in the SDK container image, bundling .NET runtime 9.0.22 (#13253)
• h2 from 4.3.0 to 4.4.1 and werkzeug from 3.1.8 to 3.1.9, patching the duplicate Host header request smuggling and the Windows device name bypass in safe_join, plus pylint 4.0.9 and filelock 4.2.1 in the development dependencies (#13257)
• GCP provider only loads service_account_key credentials of type service_account with a Google token_uri, blocking external_account configurations and custom token endpoints that could read local files or fetch arbitrary URLs (#13263)
• oauthlib from 4.0.0 to 4.0.1 in the SDK container image, patching the OAuth device flow bearer token disclosure (#13263)
• apt and libapt-pkg7.0 3.0.4 in the SDK container image (#13268)

MCP

🔐 Security

• Python base image from 3.13.16 to 3.13.18 in the MCP Server container image, patching CVE-2026-115557 (#13247)
• joserfc to 1.7.5, patching the JWE decryption denial of service advisory (#13247)
• fastmcp from 3.4.5 to 3.4.10, patching the skipped authorization check on direct calls to transformed components (#13258)