Description

Tracecat is an open-source security automation platform for teams and AI agents. From version 0.37.0 until 1.0.0-beta.49, Docker Compose deployments with SAML enabled can render SAML_SIGNED_ASSERTIONS and SAML_SIGNED_RESPONSES as empty values, overriding secure application defaults and disabling both signature requirements. An unauthenticated attacker who can reach the SAML assertion consumer endpoint can submit a forged unsigned response for an existing Tracecat user email address and obtain that user’s session. Targeting an existing superadmin can result in superadmin account takeover. Exploitation does not create users when SAML user creation is disabled and does not affect default Fargate or Helm deployments. Version 1.0.0-beta.49 removes the insecure deployment pass-through and requires signed assertions and responses.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-11-06T20:17:23.253Z",
  "pubdate": "2026-11-06T20:17:23.253Z",
  "executiveSummary": "Tracecat versions 0.37.0 through 1.0.0-beta.49 contain a critical authentication bypass vulnerability within their SAML implementation for Docker Compose deployments.\nThe flaw allows an unauthenticated attacker to supply forged, unsigned SAML assertions and responses, effectively overriding secure default signature verification requirements.\nBy targeting the SAML assertion consumer endpoint, an attacker can impersonate any existing user, including superadmin accounts, leading to full unauthorized account takeover.\nThis vulnerability is restricted to specific Docker Compose configurations; default Fargate and Helm deployments remain unaffected.\nSuccessful exploitation requires network access to the SAML consumer endpoint but does not require existing credentials.\nThis represents a high-severity risk to confidentiality, integrity, and availability, as it grants unauthenticated actors complete control over privileged user sessions.",
  "technicalDetails": "The vulnerability originates from an insecure configuration pass-through in the Tracecat deployment logic for Docker Compose. When SAML is enabled, the application environment fails to enforce strict signature validation for SAML assertions and responses.\nSpecifically, the application logic incorrectly handles the SAML_SIGNED_ASSERTIONS and SAML_SIGNED_RESPONSES parameters, allowing them to be rendered as empty values. This overrides the hardcoded secure defaults within the application, effectively disabling cryptographic signature verification for SAML exchanges.\nThe attack flow begins with the adversary identifying the SAML assertion consumer service (ACS) endpoint exposed by the target Tracecat instance. Because signature verification is disabled, the system accepts arbitrary SAML responses without verifying the origin or integrity of the assertion.\nAn unauthenticated attacker can craft a malicious, unsigned SAML response containing an identity assertion for a target user's email address. When this payload is submitted to the ACS endpoint, the Tracecat application processes the response as a valid authentication event.\nUpon successful processing, the application automatically maps the email address from the forged assertion to an existing account and issues a valid session token for that identity. If the target email belongs to a superadmin, the attacker is granted full administrative privileges.\nThe vulnerability is limited to the scope of existing users; when SAML user creation is disabled, the system will not create new accounts based on the forged assertion, but it remains susceptible to impersonation of registered users.\nTechnical root cause analysis indicates that the insecure pass-through mechanism bypasses security middleware intended to enforce mandatory assertions and response signing. This configuration error exists across all versions from 0.37.0 up to, but not including, 1.0.0-beta.49."
}