{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/checkov-by-prisma-cloud--3.4.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:palo_alto_networks:checkov_by_prisma_cloud:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-0323"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Checkov by Prisma Cloud (\u003c 3.4.2)"],"_cs_severities":["low"],"_cs_tags":["vulnerability","ssrf","devsecops","watchlist_match"],"_cs_type":"advisory","_cs_vendors":["Palo Alto Networks"],"content_html":"\u003cp\u003ePalo Alto Networks has disclosed a server-side request forgery (SSRF) vulnerability (CVE-2026-0323) in Checkov by Prisma Cloud. The vulnerability exists when Checkov is configured to download external Terraform modules (using the '--download-external-modules true' flag or configuration file setting) and processes untrusted Terraform code. An unauthenticated local user can leverage this to force the host running the scan to make unauthorized network requests to internal services.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eExploitation of this vulnerability allows an attacker with local access to conduct unauthorized network requests from the context of the Checkov process. This could potentially allow access to sensitive internal network services or metadata endpoints not otherwise reachable by the attacker. Palo Alto Networks is currently unaware of any in-the-wild exploitation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Checkov by Prisma Cloud to version 3.4.2 or later.\u003c/li\u003e\n\u003cli\u003eAudit existing Checkov deployments to determine if the '--download-external-modules' option is enabled.\u003c/li\u003e\n\u003cli\u003eImplement a policy to avoid running Checkov scans over untrusted source content.\u003c/li\u003e\n\u003cli\u003ePass configuration parameters explicitly through trusted configuration files instead of allowing them to be auto-loaded from scanned directories.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T21:54:19Z","date_published":"2026-11-11T21:54:19Z","id":"https://feed.craftedsignal.io/briefs/2026-11-checkov-ssrf-cve-2026-0323/","summary":"A server-side request forgery (SSRF) vulnerability in Checkov by Prisma Cloud (CVE-2026-0323) allows local, unauthenticated users to perform unauthorized network requests from the host when scanning untrusted Terraform configurations with external module downloading enabled.","title":"Palo Alto Networks Checkov by Prisma Cloud: Server-Side Request Forgery (CVE-2026-0323)","url":"https://feed.craftedsignal.io/briefs/2026-11-checkov-ssrf-cve-2026-0323/"}],"language":"en","title":"CraftedSignal Threat Feed - Checkov by Prisma Cloud (\u003c 3.4.2)","version":"https://jsonfeed.org/version/1.1"}