A vulnerability (CVE-2026-58490) was discovered in Tracecat, an open-source security automation platform. From version 0.37.0 to 1.0.0-beta.49, Docker Compose deployments with SAML enabled allowed an unauthenticated attacker to forge unsigned SAML responses for an existing user, potentially resulting in superadmin account takeover. This vulnerability affects users in SAML-enabled Docker Compose deployments but not in default Fargate or Helm deployments. It has been fixed in version 1.0.0-beta.49, which requires signed assertions and responses.