CVE-2026-27197: Sentry improper authentication in SAML SSO process

CVE-2026-27197 · Severity: critical · CVSS 9.1 · Published 2026-04-17

A critical vulnerability in Sentry's SAML Single Sign-On (SSO) implementation allows an attacker to take over any user account. By using a malicious identity provider on a multi-organization instance, an attacker can link their identity to a victim's account if they know the victim's email address. This could lead to full account compromise and unauthorized access to sensitive error tracking and performance data.

Technologies: sentry (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-27197 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-27197 being exploited in the wild.
How severe is CVE-2026-27197?
Critical severity, with a CVSS score of 9.1, published 17 April 2026.
Which products and versions are affected?
sentry (PyPI) ECOSYSTEM:introduced=21.12.0, ECOSYSTEM:introduced=21.12.0,fixed=26.2.0.
Is there a fix for CVE-2026-27197?
Yes. sentry (PyPI): upgrade to 26.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27197 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-27197?
Check whether you run sentry (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • sentry (PyPI): upgrade to 26.2.0 or later
    pip install "sentry>=26.2.0"

Technical details

An improper authentication vulnerability (CWE-287) exists in Sentry's SAML SSO process. The flaw allows an attacker with permissions to modify SSO settings for one organization on a multi-tenant Sentry instance to use a malicious SAML Identity Provider to link to and take over accounts in other organizations. Exploitation requires the attacker to know the victim's email address and for the instance to have SENTRY_SINGLE_ORGANIZATION set to False. The vulnerability is mitigated if individual users have two-factor authentication (2FA) enabled. A fix has been deployed to Sentry SaaS and is available for self-hosted users in version 26.2.0.

Affected products

  • Sentry Sentry >= 21.12.0, < 26.2.0

Identifiers

  • CVE-2026-27197
  • GHSA-ggmg-cqg6-j45g
  • PYSEC-2026-533

Timeline

  • 2026-02-18: patched: Fix deployed to Sentry SaaS and version 26.2.0 released.
  • 2026-02-21: advisory: NVD publication date.
  • 2026-04-17: disclosed: GitHub Advisory published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.