CVE-2026-47356 Overview
CVE-2026-47356 is a Server-Side Request Forgery (SSRF) vulnerability affecting Tenable Terrascan v1.18.3 and prior versions when running in server mode. The flaw exists in the webhook_url parameter of the file scan endpoint POST /v1/{iac}/{iacVersion}/{cloud}/local/file/scan. An unauthenticated remote attacker can supply an arbitrary URL, causing Terrascan to send the full scan results to an attacker-controlled destination. Terrascan was archived in August 2023 and no patch will be released, leaving all deployments permanently exposed. The vulnerability is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
Unauthenticated attackers can coerce Terrascan servers to send authenticated HTTP POST requests with sensitive scan data to arbitrary URLs, enabling internal network reconnaissance and data exfiltration.
Affected Products
- Tenable Terrascan v1.18.3
- All prior versions of Tenable Terrascan v1.x
- Any deployment running terrascan server mode bound to 0.0.0.0
Discovery Timeline
- 2026-05-19 - CVE-2026-47356 published to NVD
- 2026-05-20 - Last updated in NVD database
Technical Details for CVE-2026-47356
Vulnerability Analysis
The vulnerability resides in Terrascan's server mode file scan endpoint, which accepts multipart form parameters for asynchronous webhook callbacks. When a client submits a scan request, Terrascan accepts a user-supplied webhook_url value without validation or allow-listing. After completing the Infrastructure-as-Code scan, the server issues an HTTP POST request to the supplied URL.
The POST request includes the complete scan results as a JSON body. The attacker-supplied webhook_token is forwarded as a Bearer token in the Authorization header. The retryable HTTP client retries the request up to 10 times on failure, amplifying the impact against transient internal endpoints.
The terrascan server mode binds to 0.0.0.0 and requires no authentication. This exposes the SSRF primitive to any network-reachable attacker. Because Terrascan was archived in August 2023, no upstream fix will be released.
Root Cause
The root cause is missing input validation on the webhook_url parameter combined with absent authentication on the server endpoint. Terrascan treats user-controlled URLs as trusted callback destinations.
Attack Vector
A remote attacker sends a crafted multipart POST request to /v1/{iac}/{iacVersion}/{cloud}/local/file/scan containing a benign IaC file and a webhook_url pointing to an internal target. The attacker can target cloud metadata services such as http://169.254.169.254/, internal admin panels, or other services reachable from the Terrascan host. The forwarded Bearer token gives the attacker control over the Authorization header sent to the internal target.
No verified public proof-of-concept is available. Refer to the GitHub Terrascan Repository for source code analysis of the affected endpoint.
Detection Methods for CVE-2026-47356
Indicators of Compromise
- Outbound HTTP POST requests from Terrascan server hosts to unexpected external or internal IP addresses
- Repeated outbound connection attempts in groups of up to 10 to the same destination, consistent with the retryable HTTP client behavior
- Terrascan access logs showing POST /v1/*/local/file/scan requests from untrusted sources
- Outbound traffic from Terrascan hosts targeting cloud metadata endpoints such as 169.254.169.254
Detection Strategies
- Inspect Terrascan HTTP access logs for scan endpoint requests containing webhook_url form fields referencing internal RFC1918 addresses or metadata IPs
- Correlate Terrascan process network telemetry against an allow-list of expected webhook destinations
- Alert on any unauthenticated access to the Terrascan server API from outside the management network
Monitoring Recommendations
- Capture egress traffic from Terrascan hosts via NetFlow or packet capture and baseline expected destinations
- Monitor for the Terrascan user-agent string and Bearer-token POST requests to non-approved endpoints
- Enable host-based logging to record terrascan server invocations and listener bindings
How to Mitigate CVE-2026-47356
Immediate Actions Required
- Stop running terrascan server mode in production environments and switch to the local CLI scan mode
- Restrict network exposure of any required Terrascan server instance behind a firewall or reverse proxy enforcing authentication
- Replace Terrascan with an actively maintained IaC scanning tool, as the project was archived in August 2023
- Audit existing Terrascan logs for prior abuse of the webhook_url parameter
Patch Information
No patch will be released. Tenable archived the Terrascan project in August 2023. Migration to a supported scanner is the only durable remediation. See the GitHub Terrascan Repository for the archive notice.
Workarounds
- Bind Terrascan server to 127.0.0.1 instead of 0.0.0.0 and proxy access through an authenticating gateway
- Enforce egress filtering on Terrascan hosts to block traffic to cloud metadata services and internal management networks
- Place Terrascan in an isolated network segment with no route to sensitive internal services
- Terminate the terrascan server process and invoke scans via CLI only
# Configuration example: restrict listener and block metadata egress
# 1. Run Terrascan bound to loopback only (no upstream flag exists; use a reverse proxy)
terrascan server -p 9010 &
iptables -A INPUT -p tcp --dport 9010 ! -s 127.0.0.1 -j DROP
# 2. Block egress to cloud metadata service from the Terrascan host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
