Sentry: Onjuiste authenticatie in het SAML SSO proces maakt gebruikersidentiteitskoppeling mogelijk

The impact of CVE-2026-27197 is severe. An attacker can exploit this vulnerability to gain unauthorized access to user accounts within a Sentry instance. This is achieved by crafting a malicious SAML response from a compromised or controlled Identity Provider. The attacker must know the victim's email address to successfully exploit the vulnerability. Successful exploitation could lead to unauthorized access to sensitive project data, source code, and other confidential information stored within Sentry. The ability to take over user accounts significantly expands the potential blast radius of this vulnerability, allowing attackers to move laterally within an organization and potentially compromise other systems connected to Sentry.

Organizations using Sentry for error tracking and performance monitoring, particularly those with multiple organizations configured and relying on SAML SSO for authentication, are at risk. Self-hosted Sentry deployments are especially vulnerable as they require manual upgrades. Shared hosting environments utilizing Sentry with multiple organizations should also be carefully assessed.

• python / server:

# Check Sentry version
import subprocess
result = subprocess.run(['sentry', '--version'], capture_output=True, text=True)
version = result.stdout.strip()
if not version.startswith('26.2.0'):
    print('Sentry version is vulnerable!')

• generic web:

# Check for SAML configuration files (example path, adjust as needed)
find /etc/sentry/ -name 'saml.conf' -print

1. 2026-02-21Disclosure

   disclosure

1. Gereserveerd2026-02-18
2. Gepubliceerd2026-02-21
3. Gewijzigd2026-02-24
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2026-27197 is to upgrade Sentry to version 26.2.0 or later, which contains the fix for this vulnerability. If upgrading immediately is not feasible, consider temporarily disabling SAML SSO if it is not essential. If multiple organizations are configured (SENTRYSINGLEORGANIZATION = False), carefully review the SAML Identity Provider configurations for any suspicious activity. Monitor Sentry logs for unusual SAML authentication attempts. While a direct WAF rule is difficult to implement, monitoring for unusual SAML request patterns could provide early warning signs. After upgrading, confirm the fix by attempting a SAML login with a test user and verifying that the authentication process functions as expected.