CVE-2026-58490

Tracecat can accept unsigned SAML identities in Docker Compose

Tracecat · Tracecat SAML authentication

First documented disclosure · Review checkpoint

Summary

Affected Compose deployments can accept unsigned identity assertions.

Severity and exploitation evidence

Critical · 9.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Empty signing settings in the Compose deployment disabled required SAML signature checks.

Conditions required

SAML must be enabled in an affected Compose deployment, with an existing target account. The stock Helm and Fargate configurations have different defaults.

Potential impact

An outsider can obtain a session for an existing user, including a privileged account.

Affected versions and configurations

0.37.0 to before 1.0.0-beta.49, affected Docker Compose SAML configuration only.

Fix and mitigation status

1.0.0-beta.49.

Practical next steps

Upgrade to 1.0.0-beta.49 or later and verify that unsigned responses and assertions are rejected.

Operating lesson

Ensure empty environment settings cannot disable identity-verification requirements.

Evidence and limits

The June 5 maintainer change and July advisory establish the Compose-specific configuration. Default Helm and Fargate deployments were excluded.

Sources