Vulnerability in Getsentry Sentry
CVE-2026-42354
Sentry is an error tracking and performance monitoring tool. From version 21.12.0 to before version 26.4.1, a critical vulnerability was discovered in the SAML SSO implementation of Sentry. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability. This issue has been patched in version 26.4.1.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.006 (48.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 48.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Getsentry Sentry — versions >= 21.12.0, < 26.4.1
- Sentry
Weakness classification (CWE)
References
- github.com/getsentry/sentry/commit/0c67558ae7fe08738912d4c5233b53ead048da3b (Patch)
- github.com/getsentry/sentry/pull/113720 (Patch, Issue Tracking)
- github.com/getsentry/sentry/releases/tag/26.4.1 (Product, Release Notes)
- github.com/getsentry/sentry/security/advisories/GHSA-rcmw-7mc7-3rj7 (Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-42354?
- CVE-2026-42354 is a critical-severity vulnerability in Getsentry Sentry, classified under Authentication Bypass by Spoofing. CVSS score: 9.1/10. Published 2026-05-08.
- How severe is CVE-2026-42354?
- Critical severity. CVSS v3 base score is 9.1 out of 10.