Low-severity SSRF vulnerability CVE-2026-0323 in Checkov by Prisma Cloud allows local unauthenticated users to make network requests
Palo Alto Networks has disclosed CVE-2026-0323, a server-side request forgery (SSRF) vulnerability affecting Checkov by Prisma Cloud. This flaw enables a local unauthenticated attacker to make unauthorized network requests from the host to internal services. However, exploitation requires the Checkov deployment to be configured to download external Terraform modules from untrusted sources. The vulnerability is rated low severity with a CVSS score of 4.0, though moderate urgency is suggested due to the potential risk. Palo Alto Networks is currently unaware of any active exploitation in the wild. Until a patch is available, it is recommended to avoid scanning untrusted content and explicitly configure settings instead of auto-loading from scan directories.
Entenda a falha
A vulnerabilidade
CVE-2026-0323 is a server-side request forgery (SSRF, CWE-918) in Checkov by Prisma Cloud from Palo Alto Networks. It lets a local, unauthenticated user make unauthorized network requests from the host to internal services. It only affects deployments that download external Terraform modules (--download-external-modules true, or download-external-modules: true in a config file) and scan Terraform from untrusted sources. Versions 3.4.0 up to but not including 3.4.2 are affected. Palo Alto rates it LOW (CVSS-B 4.8, CVSS-BT 1.1) with MODERATE suggested urgency. The story cites a CVSS of 4.0, which is the CVSS version in the vector, not the score.
Como funciona
Checkov scans Terraform configurations. When external module downloading is enabled, it fetches modules referenced by the content being scanned. The advisory also says configuration can be auto-loaded from the scanned directory. So untrusted content can influence the network requests the host makes, and those requests can reach internal services. The articles do not detail the exact step where the request is redirected.
Por que é vulnerável
The classification is SSRF: the tool can be induced to make requests on an attacker's behalf. The advisory's mitigations point to two contributing factors: downloading external modules while scanning untrusted content, and configuration being auto-loaded from the scanned directory instead of a trusted file. The articles do not describe the code-level root cause or what the 3.4.2 fix changes.
Como foi descoberta
The articles do not say who found the flaw or how. Palo Alto Networks disclosed it in its own security advisory, published on 2026-11-11, and says it is not aware of any malicious exploitation.
Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 14:17.
Detalhes técnicos
CVE-2026-0323 is classified as CWE-918 Server-Side Request Forgery (SSRF), where an attacker can potentially induce the server to make requests on their behalf. The exposure applies only to Checkov versions 3.4.0 through before 3.4.2 with the '--download-external-modules true' setting enabled.
Remediação
Affected users should upgrade Checkov to version 3.4.2 or later when available. Meanwhile, avoid running Checkov scans on untrusted Terraform content and explicitly specify trusted configuration files rather than relying on auto-loaded configurations from the scan directory.
Linha do tempo
-
Low-severity SSRF vulnerability CVE-2026-0323 in Checkov by Prisma Cloud allows local unauthenticated users to make network requests
ler a análise desta fonte ocultar
Palo Alto Networks has disclosed CVE-2026-0323, a server-side request forgery (SSRF) vulnerability affecting Checkov by Prisma Cloud. This flaw enables a local unauthenticated attacker to make unauthorized network requests from the host to internal services. However, exploitation requires the Checkov deployment to be configured to download external Terraform modules from untrusted sources. The vulnerability is rated low severity with a CVSS score of 4.0, though moderate urgency is suggested due to the potential risk. Palo Alto Networks is currently unaware of any active exploitation in the wild. Until a patch is available, it is recommended to avoid scanning untrusted content and explicitly configure settings instead of auto-loading from scan directories.
Technical Details
CVE-2026-0323 is classified as CWE-918 Server-Side Request Forgery (SSRF), where an attacker can potentially induce the server to make requests on their behalf. The exposure applies only to Checkov versions 3.4.0 through before 3.4.2 with the '--download-external-modules true' setting enabled.
Remediation
Affected users should upgrade Checkov to version 3.4.2 or later when available. Meanwhile, avoid running Checkov scans on untrusted Terraform content and explicitly specify trusted configuration files rather than relying on auto-loaded configurations from the scan directory.