/
← Voltar ao feed
low

Palo Alto Networks discloses CVE-2026-0311, an SSRF vulnerability in Checkov by Prisma Cloud before 3.2.533

1 fonte(s) · 1 atualização(ões) · publicado 14/10/2026 13:00 · coletado há 7 horas

Palo Alto Networks disclosed CVE-2026-0311, a server-side request forgery (SSRF, CWE-918) vulnerability in Checkov by Prisma Cloud. A local unauthenticated user can make unauthorized network requests from the host to internal services. The vendor rates it LOW severity with MODERATE suggested urgency (CVSS-B 4.8, CVSS-BT 1.1) and says it is not aware of any malicious exploitation. No special configuration is required for exposure.

Technical Details

  • Affected versions: Checkov by Prisma Cloud from 3.2.0 (inclusive) up to 3.2.533 (exclusive).
  • Weakness classes: CWE-918 and CAPEC-664 (Server Side Request Forgery).
  • CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:U. It is a local attack vector requiring passive user interaction, with the exploit maturity rated unreported.
  • The workaround suggests that configuration auto-loaded from the scanned directory is relevant to the attack path. The article does not describe the mechanism in more detail.

Remediation

  • Upgrade Checkov to version 3.2.533 or later.
  • Until a fixed version is deployed, avoid running Checkov over untrusted content.
  • Pass configuration explicitly through a trusted configuration file rather than allowing it to be auto-loaded from the scanned directory.

Linha do tempo

  1. security.paloaltonetworks.com ↗ · pub. 14/10/2026 13:00 · coletado 20/10 16:32 primeiro registro

    Palo Alto Networks discloses CVE-2026-0311, an SSRF vulnerability in Checkov by Prisma Cloud before 3.2.533

    ler a análise desta fonte

    Palo Alto Networks disclosed CVE-2026-0311, a server-side request forgery (SSRF, CWE-918) vulnerability in Checkov by Prisma Cloud. A local unauthenticated user can make unauthorized network requests from the host to internal services. The vendor rates it LOW severity with MODERATE suggested urgency (CVSS-B 4.8, CVSS-BT 1.1) and says it is not aware of any malicious exploitation. No special configuration is required for exposure.

    Technical Details

    • Affected versions: Checkov by Prisma Cloud from 3.2.0 (inclusive) up to 3.2.533 (exclusive).
    • Weakness classes: CWE-918 and CAPEC-664 (Server Side Request Forgery).
    • CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:U. It is a local attack vector requiring passive user interaction, with the exploit maturity rated unreported.
    • The workaround suggests that configuration auto-loaded from the scanned directory is relevant to the attack path. The article does not describe the mechanism in more detail.

    Remediation

    • Upgrade Checkov to version 3.2.533 or later.
    • Until a fixed version is deployed, avoid running Checkov over untrusted content.
    • Pass configuration explicitly through a trusted configuration file rather than allowing it to be auto-loaded from the scanned directory.