CVE-2026-47356: SSRF
Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the webhookurl parameter in the file scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/local/file/scan) when running in server mode. An unauthenticated remote attacker can supply an arbitrary URL as the webhookurl multipart form parameter. After scanning the uploaded file, Terrascan sends an HTTP POST request to the attacker-controlled URL containing the full scan results as a JSON body, with the attacker-supplied webhooktoken forwarded as a Bearer token in the Authorization header. The retryable HTTP client retries up to 10 times on failure. This affects deployments running terrascan in server mode (terrascan server), which binds to 0.0.0.0 with no authentication. Note: Terrascan was archived in August 2023 and no patch will be released.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Restrict Terrascan server from running with no authentication; require authentication for the server mode endpoints (including the file scan endpoint POST /v1/{iac}/{iacVersion}/{cloud}/local/file/scan).
Terrascan server Authentication = enabled - Compensating control
Network-restrict access to Terrascan server: bind to localhost or restrict inbound access to the server mode port so only trusted clients can reach it (current exposure mentioned as binding to 0.0.0.0 with no authentication).
- Compensating control
Egress-filter outbound traffic from the Terrascan server to prevent SSRF from reaching attacker-controlled webhook_url targets (allow only required destinations).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47356?
The severity of CVE-2026-47356 is rated high, with a score of 8.7.
How does CVE-2026-47356 affect Terrascan?
CVE-2026-47356 affects Terrascan versions v1.18.3 and prior by allowing Server-Side Request Forgery through the webhook_url parameter.
What systems are impacted by CVE-2026-47356?
CVE-2026-47356 impacts systems running Accurics Terrascan and Tenable Terrascan in server mode.
How do I mitigate CVE-2026-47356?
To mitigate CVE-2026-47356, upgrade to Terrascan version v1.18.4 or later.
What potential consequences does CVE-2026-47356 pose?
CVE-2026-47356 allows an unauthenticated remote attacker to exploit SSRF vulnerabilities, potentially leading to sensitive information exposure.