CVE-2026-47358 Details
Description
Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in uploaded IaC templates when running in server mode. When Terrascan parses uploaded ARM templates or CloudFormation templates, it resolves external URLs referenced within those templates via hashicorp/go-getter with all default detectors enabled, including FileDetector. An unauthenticated remote attacker can upload an ARM template containing a templateLink.uri or parametersLink.uri field, or a CloudFormation template containing an AWS::CloudFormation::Stack TemplateURL field, pointing to an attacker-controlled URL. Terrascan will fetch the attacker-controlled URL server-side. Unlike SSRF via the remote scan endpoint, file:// URLs are directly usable without requiring an X-Terraform-Get redirect, enabling local file read. This affects deployments running terrascan in server mode (terrascan server), which binds to 0.0.0.0 with no authentication. Note: Terrascan was archived in August 2023 and no patch will be released.
A Server-Side Request Forgery (SSRF) vulnerability has been identified in Tenable Terrascan versions through 1.18.3. This vulnerability arises when Terrascan is run in server mode, where it processes uploaded Infrastructure as Code (IaC) templates such as Azure Resource Manager (ARM) or AWS CloudFormation. During this parsing, Terrascan resolves external URLs referenced in the templates using the hashicorp/go-getter library, with all default detectors activated, including the FileDetector. An unauthenticated remote attacker can exploit this by uploading a template that includes a link to an attacker-controlled URL. Terrascan will then fetch this URL server-side, potentially leading to unauthorized access to internal resources or files. This issue is particularly concerning because it allows direct access to local files without the need for a specific redirect, which is usually required for file URLs.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tenable/terrascan | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
| CWE-610 | Externally Controlled Reference to a Resource in Another Sphere | [email protected] |
| CWE-73 | External Control of File Name or Path | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tenable terrascan | <= 1.18.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 20, 2026 | Initial Analysis | [email protected] |
| May 19, 2026 | New CVE Received | [email protected] |