Critical severity · published May 8, 2026
CVE-2026-42354
Sentry: Improper authentication on SAML SSO process allows user identity linking
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
Sentry is an error tracking and performance monitoring tool. From version 21.12.0 to before version 26.4.1, a critical vulnerability was discovered in the SAML SSO implementation of Sentry. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability. This issue has been patched in version 26.4.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
sentry · getsentry
>= 21.12.0, < 26.4.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42354
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42354
Patch
https://github.com/getsentry/sentry/commit/0c67558ae7fe08738912d4c5233b53ead048da3b
Issue Tracking
https://github.com/getsentry/sentry/pull/113720
Product
https://github.com/getsentry/sentry/releases/tag/26.4.1
Mitigation
https://github.com/getsentry/sentry/security/advisories/GHSA-rcmw-7mc7-3rj7
More from sentry
9.1
CVE-2026-27197
Sentry: Improper Authentication on SAML SSO process allows user identity linking
7.7
CVE-2026-83803
Sentry: Unsafe pickle deserialization in Relocation Feature
7.6
CVE-2026-102899
Sentry: Improper authentication on SAML SSO process allows user identity linking
7.5
CVE-2026-52794
Sentry: Inefficient Regular Expression Complexity in sentry
6.5
CVE-2026-26004
Sentry allows unauthorized access to event data across organizational boundaries