Sentry SAML SSO Critical Vulnerability Allows Account Takeover (CVE-2026-42354)
A critical vulnerability, tracked as CVE-2026-42354, has been identified in the SAML Single Sign-On (SSO) implementation of Sentry, the popular error tracking and performance monitoring tool. The National Vulnerability Database reports this flaw affects Sentry versions from 21.12.0 up to, but not including, 26.4.1. This is a severe issue, scoring 9.1 CVSS, that demands immediate attention from Sentry users.
The vulnerability enables an attacker to seize control of any user account within a Sentry instance. The attack vector involves leveraging a malicious SAML Identity Provider (IdP) and another organization on the same Sentry instance. While the victim’s email address must be known to facilitate exploitation, this is often trivial to obtain. The National Vulnerability Database categorizes this under CWE-290 (Authentication Bypass by Spoofing).
Sentry has addressed this critical flaw in version 26.4.1. Organizations using affected Sentry versions must prioritize upgrading to the patched release immediately. Failure to do so leaves Sentry instances wide open to account compromise, potentially giving attackers access to sensitive debugging information, performance data, and even code repositories integrated with Sentry.
What This Means For You
- If your organization uses Sentry, you need to check your version immediately. If you are running any version from 21.12.0 to 26.4.0, you are vulnerable to account takeover via CVE-2026-42354. Patch to version 26.4.1 or higher without delay. This isn't theoretical; an attacker with a known email can fully compromise Sentry accounts.
Related ATT&CK Techniques
🛡️ Detection Rules
2 rules · 6 SIEM formats2 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
Sentry SAML SSO Account Takeover Attempt - CVE-2026-42354
title: Sentry SAML SSO Account Takeover Attempt - CVE-2026-42354
id: scw-2026-05-08-ai-1
status: experimental
level: critical
description: |
Detects potential exploitation of CVE-2026-42354 by monitoring for POST requests to Sentry's SAML login endpoint, which is indicative of an attempt to use a malicious SAML Identity Provider for account takeover. This rule specifically targets the SAML SSO flow that is vulnerable in affected Sentry versions.
author: SCW Feed Engine (AI-generated)
date: 2026-05-08
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-42354/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: authentication
detection:
selection:
cs-uri|contains:
- '/login/saml/'
cs-method|exact:
- 'POST'
sc-status|exact:
- '302'
referer|contains:
- '/login/'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-42354 | Auth Bypass | Sentry SAML SSO implementation |
| CVE-2026-42354 | Auth Bypass | Sentry versions 21.12.0 to before 26.4.1 |
| CVE-2026-42354 | Account Takeover | Sentry SAML SSO vulnerability allowing account takeover via malicious SAML Identity Provider |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 09, 2026 at 02:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-6667 — PgBouncer before 1.25.2 did not perform an appropriate
CVE-2026-6667 — PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console...
CVE-2026-6666 — A possible null pointer reference in PgBouncer before
CVE-2026-6666 — A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE...
PgBouncer SCRAM Vulnerability (CVE-2026-6665) Allows Stack Overflow
CVE-2026-6665 — The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM...