What happened
A critical (CVSS 9.8) authentication bypass in Tracecat's SAML handling: Docker Compose deployments with SAML enabled pass empty signature-requirement environment values, turning off SAML signature verification. An unauthenticated client can then forge an unsigned SAML response for any existing user email and obtain that user's session, escalating to superadmin takeover if a superadmin is targeted.
Why it matters
Tracecat sits in the security-automation layer that many teams use to run and coordinate AI-agent workflows; full account takeover of that control plane lets an attacker drive the very agents/automations the platform orchestrates and pivot into connected infrastructure.
Attack vector
Docker Compose renders SAML_SIGNED_ASSERTIONS and SAML_SIGNED_RESPONSES as empty values, overriding secure defaults and disabling both signature requirements (CWE-347). An unauthenticated attacker submits a forged unsigned SAML response for an existing user's email to obtain that user's session; targeting a superadmin yields full account takeover.
Affected systems
Tracecat 0.37.0 to <1.0.0-beta.49 (Docker Compose + SAML)
Mitigation
Upgrade to Tracecat 1.0.0-beta.49, which removes the insecure deployment pass-through and requires signed assertions/responses.