SAML Vulnerability in Tracecat Security Automation Platform

CVE-2026-58490

What is CVE-2026-58490?

The Tracecat security automation platform presents a significant SAML vulnerability that affects deployments with SAML enabled from versions 0.37.0 up to 1.0.0-beta.49. Under these conditions, Docker Compose setups can unintentionally render SAML_SIGNED_ASSERTIONS and SAML_SIGNED_RESPONSES as empty, thus bypassing critical security settings. An attacker able to access the SAML assertion consumer endpoint can inject forged unsigned responses tied to existing user accounts, effectively hijacking user sessions. This flaw puts superadmin accounts particularly at risk, as their takeover can occur without triggering user creation when SAML user creation is off. Address this vulnerability by upgrading to version 1.0.0-beta.49, which mandates signed assertions and responses, restoring the integrity of SAML transactions.

References