Sentry is an error tracking and performance monitoring tool. From version 21.12.0 to before version 26.4.1, a critical vulnerability was discovered in the SAML SSO implementation of Sentry. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability. This issue has been patched in version 26.4.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Sentry is an error tracking and performance monitoring tool. From version 21.12.0 to before version
    26.4.1, a critical vulnerability was discovered in the SAML SSO implementation of Sentry. The
    vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider
    and another organization on the same Sentry instance. The victim email address must be known in order to
    exploit this vulnerability. This issue has been patched in version 26.4.1. (CVE-2026-42354)

The version of Sentry installed on the remote host is 21.12.0 or later but prior to 26.4.1. It is, therefore, affected by a vulnerability:

  - A critical vulnerability exists in the SAML SSO implementation of Sentry. The vulnerability allows an attacker     to take over any user account by using a malicious SAML Identity Provider and another organization on the same     Sentry instance. The victim email address must be known in order to exploit this vulnerability. Self-hosted     users are only vulnerable if they have more than one organization configured and a malicious user has existing     access and permissions to modify SSO settings for another organization. (CVE-2026-42354)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
462510	Echo: sentry: security update to 26.4.1	Tenable Cloud Security	Echo Local Security Checks	Local	critical
462510	Echo: sentry: security update to 26.4.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
313233	Sentry Python Library 21.12.x < 26.4.1 Improper Authentication (CVE-2026-42354)	Nessus	Misc.	Local	critical
441041	SCA: security update for sentry (GHSA-rcmw-7mc7-3rj7)	Tenable Cloud Security	SCA Checks	Local	critical
441041	SCA: security update for sentry (GHSA-rcmw-7mc7-3rj7)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-42354

critical

Tenable Plugins

critical

critical

critical

critical

critical