CVE-2026-47357

Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in the remote directory scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan) when running in server mode. An unauthenticated remote attacker can supply an attacker-controlled HTTP URL as remote_url with remote_type set to "http". The URL is passed directly to hashicorp/go-getter (v1.7.5) without validation. Go-getter's HttpGetter supports the X-Terraform-Get response header, allowing the attacker's server to redirect the download to a file:// URL, enabling local file read. Additionally, HttpGetter has Netrc set to true, causing it to read ~/.netrc and send stored credentials to attacker-controlled hostnames. This affects deployments running terrascan in server mode (terrascan server), which binds to 0.0.0.0 with no authentication. Note: Terrascan was archived in August 2023 and no patch will be released.

• CWE-73
• CWE-610
• CWE-918
• CWE-918

• https://github.com/tenable/terrascanProduct

Published

May 19, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47349Backend users with access to the Recycler module were able t…5.3
• CVE-2026-4735Deserialization of Untrusted Data vulnerability in DTStack c…8.7
• CVE-2026-47350Backend users were able to move records to a different page …5.3
• CVE-2026-47351Backend users were able to insert arbitrary records and file…5.3
• CVE-2026-47352Authenticated backend users were able to retrieve file metad…5.3
• CVE-2026-47356Terrascan v1.18.3 and prior are vulnerable to Server-Side Re…8.6
• CVE-2026-47358Terrascan v1.18.3 and prior are vulnerable to Server-Side Re…8.6
• CVE-2026-4736Improper Handling of Values vulnerability in No-Chicken Echo…7.3
• CVE-2026-47361In versions of the Datadog Android application prior to v541…6.4
• CVE-2026-47362In versions of the Datadog Android application prior to v554…4.6
• CVE-2026-47363In versions of the Datadog Android application prior to v541…6.3
• CVE-2026-47364In versions of the Datadog Android application prior to v545…6.5