From 63356262ffb6ff1d16792fdc5c36f7863a65b14a Mon Sep 17 00:00:00 2001 From: "Hugo P.Brito" Date: Mon, 4 May 2026 14:21:24 +0100 Subject: [PATCH] fix(api): bump Trivy to 0.70.0 in API image for CVE-2026-33186 - Patch gRPC-Go auth bypass (missing leading slash in HTTP/2 :path) also in the API container image, which bundles the same Trivy CLI - Update SDK changelog entry to reflect both images are now covered --- api/CHANGELOG.md | 4 ++++ api/Dockerfile | 2 +- prowler/CHANGELOG.md | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md index 8c57285025..1932fbff65 100644 --- a/api/CHANGELOG.md +++ b/api/CHANGELOG.md @@ -8,6 +8,10 @@ All notable changes to the **Prowler API** are documented in this file. - New `scan-reset-ephemeral-resources` post-scan task zeroes `failed_findings_count` for resources missing from the latest full-scope scan, keeping ephemeral resources from polluting the Resources page sort [(#10929)](https://github.com/prowler-cloud/prowler/pull/10929) +### 🔐 Security + +- `trivy` binary in the API image from 0.69.2 to 0.70.0, patching CVE-2026-33186 (gRPC-Go authorization bypass via missing leading slash in HTTP/2 `:path`) + --- ## [1.26.1] (Prowler v5.25.1) diff --git a/api/Dockerfile b/api/Dockerfile index 6f8385934d..55b14dcf16 100644 --- a/api/Dockerfile +++ b/api/Dockerfile @@ -5,7 +5,7 @@ LABEL maintainer="https://github.com/prowler-cloud/api" ARG POWERSHELL_VERSION=7.5.0 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION} -ARG TRIVY_VERSION=0.69.2 +ARG TRIVY_VERSION=0.70.0 ENV TRIVY_VERSION=${TRIVY_VERSION} ARG ZIZMOR_VERSION=1.24.1 diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index cb0a9adc1b..4250f657a0 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -30,7 +30,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Parser-mismatch SSRF in image provider registry auth where crafted bearer-token realms and pagination links could force requests to internal addresses and leak credentials cross-origin [(#10945)](https://github.com/prowler-cloud/prowler/pull/10945) - `cryptography` from 46.0.6 to 46.0.7, patching CVE-2026-39892 (out-of-bounds read on non-contiguous buffers passed to `Hash.update()` and similar APIs) -- `trivy` binary in the SDK image from 0.69.2 to 0.70.0, patching CVE-2026-33186 (gRPC-Go authorization bypass via missing leading slash in HTTP/2 `:path`) +- `trivy` binary in the SDK and API images from 0.69.2 to 0.70.0, patching CVE-2026-33186 (gRPC-Go authorization bypass via missing leading slash in HTTP/2 `:path`) ---