EUVD-2026-101676
GHSA-c29w-h8jf-rqpv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply malicious IaC content to target
-
DeliveryVictim runs Checkov scan on host
-
ExploitParser issues crafted internal request (SSRF)
-
ExecutionReach internal/metadata services
-
ImpactLimited internal exposure or disruption
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to influence the Infrastructure-as-Code content that Checkov parses, and a victim must actually run a Checkov scan on a host that has network reachability to the internal services of interest (UI:P passive interaction, AV:L local vector). It does not require authentication (PR:N) but is NOT remotely triggerable over the network - the attacker needs their crafted input to be processed locally by the tool. Limiting factors: the host must be positioned to reach valuable internal/metadata endpoints, impact is confined to low-severity SSRF (no confidentiality/integrity impact on the Checkov host itself), and only versions below 3.2.533 are affected, so patched deployments are not exploitable. |
| Impact | This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The vendor-assigned CVSS 4.0 score is only 1.1, driven by a local attack vector (AV:L), passive user interaction (UI:P), no privileges (PR:N), and only minor availability/subsequent-system impact (VA:L/SC:L/SI:L) with no confidentiality or integrity impact on the vulnerable system itself. Exploitation is reflected in the CVSS temporal field as E:U (unproven), there is no CISA KEV listing and no public POC identified, so exploitation status is 'no public exploit identified at time of analysis.' The one nuance worth flagging: the vector is PR:N (unauthenticated) yet AV:L (local), which matches the description's phrase 'local unauthenticated user' - the attacker does not need credentials but must already be able to run Checkov locally against attacker-influenced input, which is the realistic limiting factor. Bottom line: a real-but-minor SSRF in a developer/CI tool, not an urgent patch priority, and a patch is already available. |
| Exploit ScenarioDerived | An attacker crafts a malicious Infrastructure-as-Code configuration (e.g., in a pull request or shared repo) that, when scanned by Checkov on a developer or CI host, coerces the tool into issuing network requests to internal services the host can reach. Because the vector is local with passive user interaction (UI:P), the victim simply runs a routine scan over the attacker-supplied content; no public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Server-side request forgery in Palo Alto Networks Checkov by Prisma Cloud before version 3.2.533 allows a local unauthenticated attacker to induce the tool to make unauthorized network requests from the host to internal services. The attacker must influence Infrastructure-as-Code content parsed by Checkov, and a victim must run a scan on a host with network reachability to the target services; it is not remotely triggerable. No public exploit code has been identified, and the impact is limited to low-severity SSRF without confidentiality or integrity impact on the Checkov host itself, though other systems may experience low confidentiality impact. A vendor patch is available in version 3.2.533.
RemediationAI
Upgrade to Checkov by Prisma Cloud version 3.2.533 or later. The vendor has released a patch. As a compensating control, restrict network access from hosts running Checkov scans to only necessary endpoints, and avoid running scans with untrusted IaC content in environments that have access to sensitive internal services or cloud metadata endpoints. Note that restricting network access may break legitimate scans that require fetching remote modules. Run Checkov in an isolated container or sandbox without network connectivity to internal services when processing untrusted IaC. Monitor for anomalous outbound requests from CI/CD runners or developer workstations performing Checkov scans. Refer to the vendor advisory at https://security.paloaltonetworks.com/CVE-2026-0311 for updated information.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a server-side request forgery (SSRF, CWE-918) vulnerability in Checkov by Prisma Cloud, a static analysis tool for Infrastructure-as-Code (IaC) that parses Terraform, CloudFormation, Kubernetes manifests, and similar files. During scanning, certain IaC constructs-such as remote module sources or URLs embedded in resource definitions-can cause Checkov to make network requests. If an attacker can influence the IaC content being scanned, they can manipulate these requests to target internal services, including cloud metadata endpoints or internal APIs, leading to information disclosure. The attack vector is local (AV:L) and requires user interaction (UI:R) because the victim must run the scan, but no authentication is required (PR:N). The scope is changed (S:C) with low confidentiality impact (C:L) on other systems, while the vulnerable component itself has no integrity or availability impact. Affected versions are prior to 3.2.533.
Know when Checkov By Prisma Cloud gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber
Local tool execution on attacker-influenced IaC (AV:L) with no auth (PR:N) but a required scan action (UI:R); SSRF crosses to internal services (S:C) exposing limited data (C:L).
Primary rating from Vendor (palo_alto).
CVSS VectorVendor: palo_alto
Lifecycle Timeline
1DescriptionCVE.org
A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
More in Checkov By Prisma Cloud
View allPath traversal in Prisma Cloud Checkov enables an unauthenticated local attacker to write files to arbitrary locations o
Arbitrary code execution in Palo Alto Networks Checkov - the Prisma Cloud IaC static-analysis scanner - triggers when th
OS command injection in Palo Alto Networks Checkov by Prisma Cloud allows a local low-privileged user to execute arbitra
Exploit-DB