A vulnerability (CVE-2026-58490) was identified in Tracecat, a security automation platform, affecting Docker Compose deployments with SAML enabled. Versions 0.37.0 through 1.0.0-beta.49 were vulnerable, allowing an attacker to submit a forged unsigned SAML response and obtain an existing user's session, potentially leading to superadmin account takeover. This exploit does not create new users when SAML user creation is disabled and does not affect Fargate or Helm deployments. Version 1.0.0-beta.49 resolves the issue by requiring signed assertions and responses.