OS Command Injection in Checkov by Prisma Cloud

Palo Alto Networks has disclosed an OS command injection vulnerability (CVE-2026-0302) affecting Checkov by Prisma Cloud versions 3.2.0 through 3.2.501. The vulnerability is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command. It enables a local, low-privileged user to execute arbitrary commands within the context of the running Checkov process.

The exploitation requires the attacker to influence the input consumed by a Checkov scan. While the vulnerability is classified with a low severity score, successful exploitation leads to high integrity and confidentiality impact on the affected environment. Palo Alto Networks is currently unaware of any active malicious exploitation of this issue. Users are advised to upgrade to version 3.2.502 or later to remediate the vulnerability, as no workarounds are available.

Impact

Successful exploitation of this vulnerability allows a local user to execute arbitrary commands with the privileges of the Checkov process. This can lead to unauthorized access to sensitive data, modification of infrastructure-as-code files, or further escalation within the host environment. The impact on confidentiality and integrity is high.

Recommendation

• Upgrade all instances of Checkov by Prisma Cloud to version 3.2.502 or later immediately.
• Audit build pipelines and local scanning workflows that process untrusted configuration files.
• Restrict access to Checkov execution environments to trusted users only, as the vulnerability requires local access to influence scan inputs.