Palo Alto Networks Checkov by Prisma Cloud: Server-Side Request Forgery (CVE-2026-0323)

Palo Alto Networks has disclosed a server-side request forgery (SSRF) vulnerability (CVE-2026-0323) in Checkov by Prisma Cloud. The vulnerability exists when Checkov is configured to download external Terraform modules (using the '--download-external-modules true' flag or configuration file setting) and processes untrusted Terraform code. An unauthenticated local user can leverage this to force the host running the scan to make unauthorized network requests to internal services.

Impact

Exploitation of this vulnerability allows an attacker with local access to conduct unauthorized network requests from the context of the Checkov process. This could potentially allow access to sensitive internal network services or metadata endpoints not otherwise reachable by the attacker. Palo Alto Networks is currently unaware of any in-the-wild exploitation.

Recommendation

• Upgrade Checkov by Prisma Cloud to version 3.4.2 or later.
• Audit existing Checkov deployments to determine if the '--download-external-modules' option is enabled.
• Implement a policy to avoid running Checkov scans over untrusted source content.
• Pass configuration parameters explicitly through trusted configuration files instead of allowing them to be auto-loaded from scanned directories.