fix(deps): update toniblyx/prowler docker tag to v5.41.0

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
toniblyx/prowler	minor	5.2.0 → 5.41.0

---

Release Notes

prowler-cloud/prowler (toniblyx/prowler)

v5.41.0: Prowler 5.41.0

Compare Source

✨ New features to highlight in this version

Enjoy them all now for free at https://cloud.prowler.com/

📥 Scans — Import Findings from the Browser

[!NOTE]
This feature is available exclusively in Prowler Cloud and Prowler Private Cloud with a subscription.

Findings produced outside the platform, by the Prowler CLI or a CI pipeline, can now be brought into the app without leaving the browser. The Scans page gains an "Import Findings" dialog that takes a Prowler .ocsf.json report by drag-and-drop or file picker, hands it to the ingestion API and tracks the job to completion, reporting how many records were processed and how many were invalid. Files that are not a .ocsf.json report, or are empty, are refused before any upload starts, and a rejected upload or a failed status poll can be retried in place. The dialog is available to roles holding the Manage Ingestions permission.

Read more in the Import Findings documentation.

🎫 Jira Integration — Finding Reference in Every Issue

Every Jira issue created from a finding now carries a stable reference back to it. Issues are labeled prowler, prowler-<provider>, prowler-<severity>, prowler-<check-id> and prowler-finding-<finding-uid>, so they can be filtered, searched with JQL or matched by automation; labels are sanitized to Jira's limits so a long or unusual value never blocks issue creation. The issue also links back to the finding in Prowler, filtered by its UID so the link keeps working after later scans, and names the Prowler organization that sent it. Prowler Cloud always includes the link; Prowler Local Server enables it by setting DJANGO_UI_BASE_URL in the API environment.

Read more in the Jira integration documentation.

📚 Compliance — CIS Google Workspace Foundations Benchmark v1.4.0

Prowler now ships the CIS Google Workspace Foundations Benchmark v1.4.0. Alongside the new framework, the Google Workspace checks mapped to CIS were reworked to evaluate the benchmark's full audit procedure instead of a single condition, so Gmail spoofing actions, 2-Step Verification, password expiration and alert severity left on Google's defaults no longer pass. Expect new FAIL findings on domains that rely on those defaults. Three accuracy fixes also land:

• security_2sv_enforced and security_2sv_hardware_keys_admins report MANUAL instead of judging domain-wide values that a group or a sub-organizational unit overrides; a domain-wide failure is still reported as such, with the override noted.
• rules_*_alert_configured no longer passes a rule whose delivery to the alert center is disabled.
• security_password_policy_strong no longer fails a domain that never touched the password strength setting, since Google enforces strong passwords by default.

security_login_challenges_configured was unmapped from CIS Google Workspace requirement 4.1.4.1 (Post-SSO verification) and security_2sv_enforced from CISA SCuBA GWS.COMMONCONTROLS.1.1 (phishing-resistant MFA), because neither check can prove what those requirements ask for.

Read more in the Compliance documentation.

🔍 Checks

Ten new AWS checks land in this release, eight of them contributed by @​tamg-aws. Thank you!

Amazon Bedrock AgentCore

• iam_policy_passrole_to_bedrock_agentcore_restricted flags customer-managed IAM policies that allow iam:PassRole over every role where the passed role can reach Bedrock AgentCore, so any principal holding the policy could run agent code under any role in the account.
• iam_policy_no_agentcore_workload_access_token_wildcard flags customer-managed IAM policies that allow bedrock-agentcore:GetWorkloadAccessToken, GetWorkloadAccessTokenForJWT or GetWorkloadAccessTokenForUserId on resources reaching workload identities other than the caller's own.
• cloudwatch_log_group_agentcore_data_protection_policy_enabled verifies that Bedrock AgentCore log groups mask sensitive data with a CloudWatch Logs data protection policy. The log group prefixes are configurable through agentcore_log_group_name_prefixes in config.yaml.

Amazon GuardDuty

• guardduty_runtime_monitoring_enabled flags detectors without unified Runtime Monitoring, the only feature that covers Amazon EC2 instances and Amazon ECS on AWS Fargate tasks in addition to Amazon EKS.
• guardduty_ai_protection_enabled flags detectors without AI Protection, which analyzes CloudTrail data events from Amazon Bedrock, Amazon Bedrock AgentCore and Amazon SageMaker AI. A detector that does not report the feature is MANUAL rather than FAIL.

guardduty_eks_runtime_monitoring_enabled no longer reports FAIL for detectors that use unified Runtime Monitoring, which is mutually exclusive with EKS_RUNTIME_MONITORING and already covers Amazon EKS.

Amazon ECR and EKS

• ecr_registry_enhanced_scanning_enabled verifies that the ECR registry scan type is enhanced (Amazon Inspector, covering programming language packages and continuous rescanning) instead of basic, reporting MANUAL when the registry scanning configuration cannot be read.
• eks_cluster_vpc_cni_network_policy_enforced flags EKS clusters whose Amazon VPC CNI managed add-on does not enable Kubernetes network policy enforcement, reporting MANUAL where the EKS API cannot show the setting.

AWS IAM, Elastic Beanstalk and MemoryDB

• iam_role_service_trust_restricts_source_to_account flags IAM roles whose trust policy lets an AWS service principal assume the role without confining the request to a specific source account, including trust policies that iam_role_cross_service_confused_deputy_prevention does not evaluate.
• elasticbeanstalk_environment_no_secrets_in_configuration scans the option settings of every Elastic Beanstalk environment for hardcoded secrets. Thanks to @​haneul-24!
• memorydb_cluster_in_transit_encryption_enabled verifies that MemoryDB clusters have in-transit encryption (TLS) enabled. Thanks to @​UTKARSH698!

Explore all AWS checks at Prowler Hub.

🐳 Image Provider — On-Premises Registries

Scanning registries that live on private networks is now supported end to end. PROWLER_IMAGE_PROVIDER_ALLOWED_PRIVATE_NETWORKS takes a comma-separated list of IPs and CIDRs the provider may reach, while every other non-public address, including link-local and loopback, stays blocked by the SSRF guard. Authentication negotiation is also more resilient: the provider falls back to Basic when a registry such as Harbor rejects the negotiated bearer token, and switches to a bearer token when the server answers a Basic or anonymous request with a Bearer challenge. --registry-insecure now propagates to Trivy through TRIVY_INSECURE, so images behind self-signed certificates can be pulled and scanned, not just enumerated. The flag now disables certificate validation for the image pull too, so keep it for trusted internal registries only.

Registry scans also skip non-image OCI artifacts (Helm charts, cosign signatures, SBOM attestations), no longer abort the whole scan when Trivy fails on a single image, and enumerate repositories in parallel instead of one request at a time.

Read more in the Image provider documentation.

🛠️ Prowler MCP Server — Tool Failures Reported as Errors

The Prowler tools, which talk to Prowler Cloud, Private Cloud and Local Server, now report a failure as an MCP tool execution error (isError: true, with the explanation in content) instead of a successful result carrying an {"error": ...} object, which clients and models read as a success. The Prowler Documentation and Prowler Hub tools follow the same rule: prowler_docs_search no longer reports a failed search as zero matches, prowler_docs_get_document no longer reports a failed fetch as a missing page, and prowler_hub_get_check_code and prowler_hub_get_check_fixer now name the provider a check ID actually belongs to instead of reporting it as nonexistent. prowler_get_compliance_framework_state_details also rejects a call that passes both scan_id and provider_id instead of silently ignoring the provider.

Read more in the Prowler MCP documentation.

🙌 External Contributors

Thank you to our community contributors for this release!

• @​tamg-aws: GuardDuty unified Runtime Monitoring and AI Protection checks (#​12564), EKS VPC CNI network policy check (#​12661), ECR enhanced scanning check (#​12660), Bedrock AgentCore IAM and service trust checks (#​12664), AgentCore log group data protection check (#​12662), and fixes to ECR scan frequency (#​12560), CloudWatch metric filters (#​12561) and SageMaker direct internet access (#​12659)
• @​haneul-24: AWS elasticbeanstalk_environment_no_secrets_in_configuration check (#​12378)
• @​UTKARSH698: AWS memorydb_cluster_in_transit_encryption_enabled check (#​12246)
• @​ye11oc4t: GitHub repository discovery pagination for unscoped scans (#​12460)

---

UI

🚀 Added

• Finding-report imports from Scans for Cloud and Private Cloud deployments (#​12554)
• Slack integration: the connection check leaves its result on the card instead of only in a toast, naming the channel Slack refused or the channels it reached (Prowler Cloud only) (#​12677)

🔄 Changed

• Slack integration: the bot is referred to as @Prowler Cloud, identifiers are set as inline code, and the private-channel hint links to its docs (Prowler Cloud only) (#​12677)
• Slack integration: a selected private channel carries the same visible Private badge as the channel list, replacing the lock icon on the chip (Prowler Cloud only) (#​12677)

🐞 Fixed

• Cached permissions now refresh from /users/me?include=roles after access token rotation (#​12640)

API

🚀 Added

• Jira issues created from Prowler Cloud now carry the prowler, prowler-<provider>, prowler-<severity>, prowler-<check-id>, and prowler-finding-<finding-uid> labels, a link back to the finding when DJANGO_UI_BASE_URL is configured, and the tenant name (#​12540)

🐞 Fixed

• POST /api/v1/mute-rules now updates only each affected provider's latest completed scan and future scans, preventing historical reaggregation from flooding Celery queues (#​12681)

SDK

🚀 Added

• memorydb_cluster_in_transit_encryption_enabled check for AWS provider, verifying MemoryDB clusters have in-transit encryption (TLS) enabled (#​12246)
• elasticbeanstalk_environment_no_secrets_in_configuration check for AWS provider, scanning the option settings of every Elastic Beanstalk environment for hardcoded secrets (#​12378)
• CIS Google Workspace Foundations Benchmark v1.4.0 compliance framework (#​12513)
• Jira.send_finding() returns typed creation outcomes with the issue key, immutable ID and browse URL, and supports length-safe finding and delivery-attempt labels plus marker lookup for uncertain deliveries (#​12539)
• Jira.get_issues_status() resolves issue references by immutable ID in batches and returns explicit open, done, moved, missing, forbidden or unknown outcomes without treating missing issues as deleted (#​12539)
• guardduty_ai_protection_enabled check for AWS provider, flagging GuardDuty detectors without AI Protection, which analyzes AWS CloudTrail data events from Amazon Bedrock, Amazon Bedrock AgentCore and Amazon SageMaker AI; a detector that does not report the feature is MANUAL rather than FAIL (#​12564)
• guardduty_runtime_monitoring_enabled check for AWS provider, flagging GuardDuty detectors without unified Runtime Monitoring, the only feature that covers Amazon EC2 instances and Amazon ECS on AWS Fargate tasks in addition to Amazon EKS (#​12564)
• ecr_registry_enhanced_scanning_enabled check for AWS provider, verifying that the ECR registry scan type is enhanced (Amazon Inspector, covering programming language packages and continuous rescanning) instead of basic, and reporting MANUAL when the registry scanning configuration cannot be read (#​12660)
• eks_cluster_vpc_cni_network_policy_enforced check for AWS provider, flagging EKS clusters whose Amazon VPC CNI managed add-on does not enable Kubernetes network policy enforcement, and reporting MANUAL where the EKS API cannot show the setting (#​12661)
• cloudwatch_log_group_agentcore_data_protection_policy_enabled check for AWS provider, verifying that Bedrock AgentCore log groups mask sensitive data with a CloudWatch Logs data protection policy (#​12662)
• iam_policy_no_agentcore_workload_access_token_wildcard check for AWS provider, flagging customer-managed IAM policies that allow bedrock-agentcore:GetWorkloadAccessToken, GetWorkloadAccessTokenForJWT or GetWorkloadAccessTokenForUserId on resources reaching workload identities other than the caller's own, which AWS documents as the only binding on the unverified user ID the token is issued for (#​12664)
• iam_policy_passrole_to_bedrock_agentcore_restricted check for AWS provider, flagging customer-managed IAM policies that allow iam:PassRole over every role where the passed role can reach Bedrock AgentCore, so any principal holding the policy can run agent code under any role in the account (#​12664)
• iam_role_service_trust_restricts_source_to_account check for AWS provider, flagging IAM roles whose trust policy lets an AWS service principal assume the role without confining the request to a specific source account, including trust policies that iam_role_cross_service_confused_deputy_prevention does not evaluate (#​12664)
• PROWLER_IMAGE_PROVIDER_ALLOWED_PRIVATE_NETWORKS environment variable so the image provider can reach container registries on allowlisted private networks, keeping every other non-public address blocked (#​12678)
• PROWLER_AWS_PARTITION environment variable to select the AWS partition used for STS credential validation and scan bootstrap, with a clear error when the account belongs to a different partition (#​12680)

🔄 Changed

• Google Workspace checks mapped to CIS evaluate the full audit procedure instead of a single condition, so Gmail spoofing actions, 2-Step Verification, password expiration and alert severity left on Google's defaults no longer pass (#​12513)
• security_login_challenges_configured and security_2sv_enforced unmapped from CIS Google Workspace 4.1.4.1 and CISA SCuBA 0.6 GWS.COMMONCONTROLS.1.1, whose Post-SSO verification and phishing-resistant MFA requirements neither check can prove (#​12513)

🐞 Fixed

• GitHub repository discovery for unscoped scans now paginates beyond the first 100 accessible repositories instead of silently scanning only the first page (#​12460)
• rules_*_alert_configured checks no longer pass a rule whose delivery to the alert center is disabled, the setting behind the benchmark's "Ensure that Alerts is set to On" (#​12513)
• security_password_policy_strong no longer fails a domain that never touched the password strength setting: Google enforces strong passwords by default, so an unset value is the secure default and not a missing configuration (#​12513)
• security_2sv_enforced and security_2sv_hardware_keys_admins report MANUAL instead of judging domain-wide values that a group or a sub-organizational unit overrides, or that were dropped because the root organizational unit could not be resolved; a domain-wide failure is still reported as such, with the override noted (#​12513)
• ecr_registry_scan_images_on_push_enabled no longer passes a registry whose scanning rules are all MANUAL, nor describes a CONTINUOUS_SCAN registry as scanning on push; each rule's scanFrequency is now read instead of inferred from a rule's presence (#​12560)
• CloudWatch log metric filter checks no longer crash with AttributeError when the account has a metric filter whose log group was not retrieved (#​12561)
• guardduty_eks_runtime_monitoring_enabled no longer reports FAIL for detectors that use unified Runtime Monitoring; the GuardDuty service now reads the RUNTIME_MONITORING feature, which is mutually exclusive with EKS_RUNTIME_MONITORING and already covers Amazon EKS (#​12564)
• Checks no longer report FAIL when the scanning identity lacks permissions, an API is not enabled or a feature is not licensed; they now emit a single MANUAL finding naming what is required, across 28 M365, Azure, AWS and GCP checks (#​12645)
• sagemaker_notebook_instance_without_direct_internet_access_configured check logic to read the DirectInternetAccess setting instead of RootAccess, failing a notebook instance with direct internet access enabled even when root access is disabled (#​12659)
• Basic authentication fallback in the image provider when a registry rejects the negotiated bearer token, so registries like Harbor that guard catalog listing behind Basic can be enumerated (#​12678)
• Registry catalog listing when the server answers with a Bearer challenge after negotiating Basic (or anonymous) authentication, switching to a bearer token obtained from the challenge instead of failing (#​12678)
• --registry-insecure now propagates to Trivy via TRIVY_INSECURE, so images in registries with self-signed certificates can be pulled and scanned, not just enumerated (#​12678)
• Registry scans in the Image provider now skip non-image OCI artifacts (Helm charts, cosign signatures, SBOM attestations) and no longer abort the whole scan when Trivy fails on a single discovered image; registry enumeration also runs in parallel instead of one request at a time (#​12695)

MCP

🚀 Added

• Prowler App tools now report a failure as an MCP tool execution error (isError: true, explanation in content) instead of as a successful result carrying an {"error": ...} object, which clients and models read as a success (#​12532)

🔄 Changed

• prowler_get_compliance_framework_state_details now rejects a call that passes both scan_id and provider_id instead of silently ignoring the provider, which could report on a scan belonging to a different provider than the one that was asked about (#​12532)

🐞 Fixed

• prowler_hub_get_check_code and prowler_hub_get_check_fixer now report a check ID that belongs to another provider as such, naming that provider, instead of reporting the ID as one that does not exist (#​12533)
• prowler_docs_search no longer reports a failed search as zero matches or an unreadable answer as a bad search term, and prowler_docs_get_document no longer reports a failed fetch as a missing page (#​12534)

v5.40.0: Prowler 5.40.0

Compare Source

✨ New features to highlight in this version

Enjoy them all now for free at https://cloud.prowler.com/

💬 Slack Integration — Alert Channel Destinations

[!NOTE]
This feature is available exclusively in Prowler Cloud and Prowler Private Cloud with a subscription.

Alerts can now reach Slack. Connect a Slack workspace from the Integrations page, authorize one or several destination channels (the connection check confirms each channel with a one-time message and names any channel Slack refuses), and pick those channels in the alert modal's "Destination channels" selector, next to the "Recipients" selector for email. The alerts list summarizes both in a single "Destinations" column, showing a rule's email recipients and Slack channels at a glance. Disconnecting the workspace and recovering from revoked credentials are handled from the same page.

Read more in the Slack integration documentation and the Alerts documentation.

🤖 Lighthouse AI — Answer Feedback

[!NOTE]
This feature is available exclusively in Prowler Cloud and Prowler Private Cloud with a subscription.

Every Lighthouse AI answer can now be rated with a 👍 or 👎, with an optional field to describe what worked or what did not. Feedback is collected per answer, directly in the chat, and tells the team where Lighthouse should improve next.

Read more in the Lighthouse AI documentation.

📥 Providers — Imported Findings Indicator

[!NOTE]
This feature is available exclusively in Prowler Cloud and Prowler Private Cloud with a subscription.

Providers whose findings were imported with the Prowler CLI now show an "Imported provider" indicator next to their connection status in the providers table. In accounts that mix connected providers with Import Findings uploads, the table now tells them apart at a glance.

Read more in the Import Findings documentation.

📚 Compliance — NCSC Cyber Essentials 3.3

Cyber Essentials is the UK National Cyber Security Centre (NCSC) scheme certifying the baseline technical controls an organization must implement, and cloud services are explicitly in scope and cannot be excluded from an assessment. Prowler now includes NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026) as a universal framework, with its 28 requirements organized in the five control themes: Firewalls, Secure Configuration, Security Update Management, User Access Control, and Malware Protection.

Sixteen requirements map to Azure checks covering the controls the applicant organization owns under the shared responsibility model. The remaining twelve apply to end-user devices, on-premises network appliances, or organizational process, which cloud control-plane evidence cannot observe, so they are reported as Manual.

Contributed by @​m-khan-97. Thank you!

Read more in the Compliance documentation.

🔍 Checks

Fifteen new checks land across seven providers in this release.

AWS

• ecr_repository_image_no_secrets scans the latest image of each ECR repository, both its configuration and its filesystem layers, for hardcoded secrets. Thanks to @​esquaredsec!
• Four new Amazon Bedrock checks, thanks to @​tamg-aws!
  • bedrock_guardrail_contextual_grounding_filter_enabled verifies that guardrails enable both contextual grounding filters, blocking responses that are not supported by the retrieved source or do not answer the question asked.
  • bedrock_custom_model_encrypted_with_cmk verifies that custom models are encrypted at rest with a customer-managed KMS key instead of an AWS-owned key the organization cannot audit, rotate, or revoke.
  • bedrock_knowledge_base_encrypted_with_cmk verifies that each knowledge-base data source encrypts with a customer-managed KMS key the transient storage used while documents are chunked and embedded.
  • bedrock_agent_role_not_shared_across_agents verifies that every agent has a dedicated execution role, so no agent inherits another's permissions.
• rolesanywhere_profile_restricts_session_permissions flags IAM Roles Anywhere profiles that reference an administrative role without scoping down the vended session with a session policy or managed policies.

Explore all AWS checks at Prowler Hub.

GCP

• iam_workload_identity_pool_provider_attribute_condition flags Workload Identity Federation providers that trust a multi-tenant issuer without an attribute condition restricting which external identities can impersonate federated principals.

Explore all GCP checks at Prowler Hub.

GitHub

Three new checks harden GitHub Actions defaults, all contributed by @​Edneam. Thank you!

• organization_default_workflow_permissions_read_only and repository_default_workflow_permissions_read_only verify that workflows get a read-only default GITHUB_TOKEN at the organization and repository level.
• organization_actions_pull_request_approval_disabled verifies that organizations prevent GitHub Actions from creating and approving pull requests.

Explore all GitHub checks at Prowler Hub.

Microsoft 365

• defender_domain_dmarc_records_published checks that every Exchange Online domain publishes a DMARC record with an enforcing policy (p=quarantine or p=reject). Thanks to @​Rishi943!

Explore all Microsoft 365 checks at Prowler Hub.

Alibaba Cloud

• oss_bucket_versioning_enabled verifies that OSS buckets keep versioning enabled, allowing recovery from accidental or malicious object overwrite and deletion. Thanks to @​abidedavana!
• oss_bucket_server_side_encryption_enabled verifies that OSS buckets define a default server-side encryption rule, either AES256 or KMS. Thanks to @​alexchen-sys!

OSS bucket logging, versioning, default encryption, and ACL configurations are also now read correctly from the Alibaba Cloud SDK, so the checks reading them no longer report every bucket as unconfigured.

Explore all Alibaba Cloud checks at Prowler Hub.

Huawei Cloud

• vpc_security_group_open_egress flags VPC security groups that allow open egress to the internet. Thanks to @​tomitobio!

Explore all Huawei Cloud checks at Prowler Hub.

STACKIT

• ske_cluster_no_public_endpoint flags SKE clusters whose Kubernetes API endpoint is reachable from the whole internet, because the ACL extension is disabled or its allowed CIDR list contains 0.0.0.0/0 or ::/0. Thanks to @​johannes-engler-mw!

Explore all STACKIT checks at Prowler Hub.

🔐 Security Updates

• The API and SDK container images upgrade OpenSSL to 3.5.7-1~deb13u2, patching ten high CVEs; the UI image upgrades libcrypto3 and libssl3 to 3.5.8-r0, patching seven high CVEs; the MCP Server image patches CVE-2026-14456 (OpenSSL), CVE-2026-11822, and CVE-2026-11824 (SQLite).
• sqlparse upgraded to 0.6.0 in the API, patching CVE-2026-54284, CVE-2026-59893, and CVE-2026-71491.

🙌 External Contributors

Thank you to our community contributors for this release!

• @​Edneam: GitHub organization_default_workflow_permissions_read_only (#​12122), repository_default_workflow_permissions_read_only (#​12143), and organization_actions_pull_request_approval_disabled (#​12394) checks
• @​tamg-aws: four AWS Bedrock checks covering guardrail grounding, CMK encryption, and agent role isolation (#​12459)
• @​esquaredsec: AWS ecr_repository_image_no_secrets check (#​12123)
• @​Rishi943: Microsoft 365 defender_domain_dmarc_records_published check (#​11936)
• @​abidedavana: Alibaba Cloud oss_bucket_versioning_enabled check (#​11913)
• @​alexchen-sys: Alibaba Cloud oss_bucket_server_side_encryption_enabled check (#​11981)
• @​tomitobio: Huawei Cloud vpc_security_group_open_egress check (#​12209)
• @​johannes-engler-mw: STACKIT ske_cluster_no_public_endpoint check (#​11943)
• @​gabrielfrdev: cluster name in Kubernetes compliance report outputs (#​12506)
• @​jfgmesquita: AWS FSBP compliance mapping fix for IAM.9 and EKS.1 (#​12372)
• @​hackertwinten: ec2_securitygroup_not_used no longer flags security groups held only by scaled-down AWS Batch compute environments (#​12458)
• @​0xTaoZ: ECS task-definition checks no longer report PASS when DescribeTaskDefinition fails, shipped early in v5.39.1 (#​12217)
• @​ye11oc4t: ses_identity_not_publicly_accessible now evaluates every identity authorization policy, shipped early in v5.39.1 (#​12464)
• @​Zuhef: IaC provider raises typed exceptions instead of sys.exit when cloning the scanned repository or running Trivy fails (#​12227), Kubernetes kubelet checks no longer disappear from the scan when a kubelet-config ConfigMap is broken (#​12225), and the CLI --slack summary is sent for scans with no findings instead of failing with ZeroDivisionError (#​12229)
• @​m-khan-97: NCSC Cyber Essentials 3.3 compliance framework with Azure provider coverage across the five Cyber Essentials themes (#​11588)

---

UI

🚀 Added

• NCSC Cyber Essentials 3.3 compliance support with its dedicated mapper, details panel, and icon (#​11588)
• Thumbs-up and thumbs-down feedback form for Lighthouse assistant answers with optional details (#​12419)
• Display the default one-scan free trial and trial expiration in the existing sidebar banner (#​12420)
• Slack integration: connect a Slack workspace from the Integrations page (Prowler Cloud only) (#​12435)
• Prowler Cloud indicator for providers created via Import Findings alongside every connection status (#​12447)
• Slack integration: authorize several destination channels at once — the connection check confirms each authorized channel with a one-time message and names the one Slack refuses (#​12491)
• Slack channels confirmed on the Slack integration as alert rule destinations, selectable in the alert modal alongside email recipients (#​12492)
• Cancelled-subscription variant in the sidebar trial banner (Prowler Cloud only) (#​12538)

🔄 Changed

• Alerts list Recipients column becomes Destinations, summarizing a rule's email recipients and Slack channels at a glance (#​12493)

🐞 Fixed

• Scan auto-refresh no longer overlaps slow client refreshes and now signals when scan execution settles (#​12455)
• The compliance "Across providers" section builds its framework list from the API catalog instead of a hardcoded set of ids, so a universal framework registered by an installed package renders like a shipped one (#​12536)
• The compliance "Across providers" section reports a failed catalog request instead of rendering the "no data yet" empty state (#​12536)
• Returning from Slack after approving the install now reliably lands on the Slack integration page instead of getting stuck on the callback screen (Prowler Cloud only) (#​12572)

🔐 Security

• libcrypto3 and libssl3 upgraded to 3.5.8-r0 in the UI container image, patching seven high OpenSSL CVEs (#​12549)

API

🐞 Fixed

• FINDINGS_TABLE_PARTITION_MAX_AGE_MONTHS is now applied in months instead of days, and negative values are rejected (#​12580)

🔐 Security

• sqlparse upgraded to 0.6.0, patching CVE-2026-54284, CVE-2026-59893, and CVE-2026-71491 (#​12509)
• openssl, libssl3t64 and openssl-provider-legacy upgraded to 3.5.7-1~deb13u2 in the API container image, patching ten high OpenSSL CVEs (#​12549)

SDK

🚀 Added

• NCSC Cyber Essentials 3.3 compliance framework with Azure provider coverage across the five Cyber Essentials themes (#​11588)
• oss_bucket_versioning_enabled check for Alibaba Cloud provider, verifying that OSS buckets have versioning enabled to allow recovery from accidental or malicious object overwrite and deletion (#​11913)
• defender_domain_dmarc_records_published checks that every Exchange Online domain publishes a DMARC record with an enforcing policy (p=quarantine or p=reject) (#​11936)
• ske_cluster_no_public_endpoint check for STACKIT provider, flagging SKE clusters whose Kubernetes API endpoint is reachable from the whole internet because the ACL extension is disabled or its allowed CIDR list contains 0.0.0.0/0 or ::/0 (#​11943)
• oss_bucket_server_side_encryption_enabled check for Alibaba Cloud provider, verifying that OSS buckets have a default server-side encryption rule (AES256 or KMS) (#​11981)
• organization_default_workflow_permissions_read_only check for GitHub provider, verifying that organizations grant GitHub Actions workflows a read-only default GITHUB_TOKEN (#​12122)
• ecr_repository_image_no_secrets check for AWS provider, scanning the latest ECR repository image's configuration and filesystem layers for hardcoded secrets (#​12123)
• repository_default_workflow_permissions_read_only check for GitHub provider, verifying that repositories grant GitHub Actions workflows a read-only default GITHUB_TOKEN (#​12143)
• vpc_security_group_open_egress check for Huawei Cloud provider: VPC security groups do not allow open egress to the internet (#​12209)
• organization_actions_pull_request_approval_disabled check for GitHub provider, verifying that organizations prevent GitHub Actions from creating and approving pull requests (#​12394)
• Add the iam_workload_identity_pool_provider_attribute_condition check to flag GCP Workload Identity Federation providers that trust a multi-tenant issuer without an attribute condition restricting which external identities can impersonate federated principals (#​12416)
• Add the rolesanywhere_profile_restricts_session_permissions check to flag AWS IAM Roles Anywhere profiles that reference an administrative role without scoping down the vended session with a session policy or managed policies (#​12416)
• bedrock_guardrail_contextual_grounding_filter_enabled, bedrock_custom_model_encrypted_with_cmk, bedrock_knowledge_base_encrypted_with_cmk and bedrock_agent_role_not_shared_across_agents are four new AWS Bedrock checks covering guardrail contextual grounding, custom model encryption, knowledge-base data-source encryption, and non-shared agent execution roles. (#​12459)
• Cluster column in Kubernetes CIS, ISO27001, Prowler ThreatScore, and universal compliance outputs, populated with the resolved cluster name so multi-cluster scans can be told apart in the output (#​12506)

🐞 Fixed

• Kubernetes kubelet checks no longer disappear from the scan with TypeError: 'NoneType' object is not iterable when a kubelet-config ConfigMap is broken: one with malformed YAML is logged and skipped while the valid ones are still evaluated, one without kubelet data is evaluated with an empty configuration instead of crashing the checks, and the apiserver, controllermanager, etcd and scheduler pod gatherers now always return a list (#​12225)
• IaC provider now raises typed IacBaseException errors (repository clone, Trivy missing, scan and output processing failures) instead of calling sys.exit(1); the CLI still stops with the logged message, and API scans fail as regular task errors instead of a SystemExit escaping the worker (#​12227)
• CLI Slack integration (--slack) no longer fails when a scan produces no findings: the pass and fail percentages are guarded against a findings_count of 0, which previously raised ZeroDivisionError and sent blocks=None to Slack instead of the summary (#​12229)
• AWS FSBP compliance mapping for IAM.9 and EKS.1 referenced missing/renamed checks; both now point to their real, existing check IDs (#​12372)
• ec2_securitygroup_not_used no longer reports a false positive for security groups attached only to an AWS Batch compute environment, which holds them in configuration without creating a network interface while scaled down to zero instances (#​12458)
• Bedrock Agent ARNs are now built from the audited partition instead of a hardcoded arn:aws:, so findings in GovCloud and China carry a resolvable ARN and --resource-arn scoping matches agents in those partitions. (#​12459)
• push-to-cloud now validates Private Cloud TLS certificates with the operating system trust store without changing provider HTTP clients (#​12485)
• prowler.compliance.universal entry point directories are resolved through a single shared helper and deduplicated by resolved path, so a directory reached through two entry points is parsed once and a package that fails to import no longer hides the rest (#​12536)
• OSS bucket logging, versioning, default encryption and ACL configurations are now read correctly from the Alibaba Cloud SDK, so oss_bucket_logging_enabled, oss_bucket_versioning_enabled, oss_bucket_server_side_encryption_enabled and oss_bucket_not_publicly_accessible no longer report every bucket as unconfigured (#​12546)

🔐 Security

• openssl, libssl3t64 and openssl-provider-legacy upgraded to 3.5.7-1~deb13u2 in the SDK container image, patching ten high OpenSSL CVEs (#​12549)

MCP

🚀 Added

• Failures shared by every tool - a rejected credential, a missing permission, a rate limit, an outage, an unreachable API, a bad argument - are now explained with a message that says what went wrong and what to do about it (#​12531)

🐞 Fixed

• prowler_docs_search returns results again: it calls the search endpoint docs.prowler.com moved to, since the one it used no longer exists, and each result now names the page's title, the section it matched and a URL anchored at that section (#​12578)

🔐 Security

• Stop relaying upstream response bodies to agents: a failed request now reaches the caller as a sentence this server wrote, with the full body kept to the logs, so a gateway error page or a debug traceback can no longer be replayed into a model's context (#​12531)
• sqlite-libs upgraded to 3.53.4-r0 in the container image, patching CVE-2026-11822 and CVE-2026-11824 (#​12537)
• libcrypto3 and libssl3 upgraded to 3.5.8-r0 in the container image, patching CVE-2026-14456 (#​12547)

v5.39.1: Prowler 5.39.1

Compare Source

API

🔄 Changed

• Bump alibabacloud-tea-openapi to 0.4.6, oci to 2.184.1 and pyopenssl to 26.4.0 to match the SDK; the cryptography override now names its actual blockers (azure-cli-core pins msal below 1.37, workos 8.3.0 requires cryptography 48) (#​12477)

🐞 Fixed

• Pin zstd to 1.5.7.2; 1.5.7.3 was yanked from PyPI as not thread safe (#​12477)

🔐 Security

• Trivy from v0.72.0 to v0.73.0 in the container image, fixing HIGH CVE-2026-46600 in the bundled golang.org/x/net (#​12445)
• Trivy v0.74.0 and Debian util-linux 2.41.5-0+deb13u1 in the API container image, patching Go standard library vulnerabilities and CVE-2026-53615 (#​12470)

SDK

🐞 Fixed

• Bump alibabacloud-tea-openapi to 0.4.6, oci to 2.184.1 and pyopenssl to 26.4.0 so the published wheel installs with cryptography 50.0.0; 5.38.0 declared cryptography 50.0.0 while those packages capped it below 50, so pip could not install it and pip install prowler silently fell back to 5.37.1 (#​12477)
• Pin zstd to 1.5.7.2; 1.5.7.3 was yanked from PyPI as not thread safe (#​12477)
• ECS task-definition checks no longer report PASS when DescribeTaskDefinition fails before container evidence is gathered (#​12478)
• ses_identity_not_publicly_accessible now evaluates every SES identity authorization policy and marks mixed public Allow and Deny statements for manual review (#​12480)

🔐 Security

• Trivy from v0.72.0 to v0.73.0 in the container image, fixing HIGH CVE-2026-46600 in the bundled golang.org/x/net (#​12445)
• Trivy v0.74.0 and Debian util-linux 2.41.5-0+deb13u1 in the SDK container image, patching Go standard library vulnerabilities and CVE-2026-53615 (#​12470)

v5.39.0: Prowler 5.39.0

Compare Source

✨ New features to highlight in this version

Enjoy them all now for free at https://cloud.prowler.com/

🤖 Lighthouse AI — Finding Skills

[!NOTE]
This feature is available exclusively in Prowler Cloud and Prowler Private Cloud with a subscription.

Lighthouse AI now embeds a Skills menu on every finding, answering the questions an analyst actually asks. Contextual Fix produces the fix for the finding, Triage Decision judges whether it is real and closes it out when it is not, and Systemic Scope determines whether the problem is a one-off or everywhere. A free-form "Ask Lighthouse anything" prompt sits in the same menu, and each run shows its progress and offers follow-up actions such as creating a Jira issue or muting the finding.

Read more in the Lighthouse AI documentation.

☁️ Azure Management Group Onboarding

[!NOTE]
This feature is available exclusively in Prowler Cloud and Prowler Private Cloud with a subscription.

Azure subscriptions no longer onboard one at a time. Choose "Add Multiple Subscriptions With Azure Management Group" in the add-provider wizard, enter the Microsoft Entra tenant ID, and authenticate once with a single tenant-wide service principal: Prowler discovers the entire management-group hierarchy under the tenant root, lets you select the subscriptions to onboard, and creates their providers with the management-group structure preserved. Azure now matches the one-step onboarding that AWS Organizations and GCP organizations already have.

Read more in the Azure Management Groups documentation.

✅ Findings Triage — Verify MANUAL Findings as PASS

[!NOTE]
This feature is available exclusively in Prowler Cloud and Prowler Private Cloud with a subscription.

Checks that require human judgment report MANUAL findings. For these findings, and only for them, the triage status selector now offers Resolved: choosing it asks for the required written evidence and verifies the finding as passing. The finding then reports an effective PASS while preserving the raw MANUAL scan result, across findings, finding groups, compliance reports, and scans, with the attestation's author, evidence, and validity always visible. Attestations expire automatically after 90 days, or as soon as a new scan reports a real failure, returning the finding to the review queue.

Read more in the Findings Triage documentation.

☁️ Prowler Cloud MCP — Organizations Management and Grouped Jira Dispatch

[!NOTE]
This feature is available exclusively in Prowler Cloud and Prowler Private Cloud with a subscription.

The hosted Prowler Cloud MCP server adds eight organization tools, so an agent can onboard and manage entire cloud organizations end to end: create the organization, discover its accounts, subscriptions, and projects, apply the selection, and manage the resulting providers. The tools cover AWS Organizations, GCP organizations, and Azure tenant root management groups, and they are available to Lighthouse AI.

prowler_send_findings_to_jira also gains Cloud-only dispatch capabilities: select failed findings by check IDs against the latest completed scan, and send them in grouped mode, one Jira work item per check listing up to 50 affected resources, with per-group error reporting.

Read more in the Prowler MCP tools documentation and its Jira operations reference.

🕸️ Attack Paths — Grouped Graph with Outcome Destinations

[!NOTE]
This feature is available exclusively in Prowler Cloud and Prowler Private Cloud with a subscription.

The Attack Paths graph now reads from source to destination. Resources of the same class collapse into a single expandable node with a count, clicking reveals its members, and every path terminates in an explicit outcome node naming the destination impact: code execution, privilege escalation, public exposure, or resource inventory. The per-account hub node is gone, and the clicked resource stays highlighted while its findings are expanded.

<img width="

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

---

• Branch has one or more failed status checks