CVE-2026-47357 Overview
CVE-2026-47357 is a Server-Side Request Forgery (SSRF) vulnerability in Tenable Terrascan v1.18.3 and earlier. The flaw exists in the remote directory scan endpoint POST /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan when Terrascan runs in server mode. An unauthenticated remote attacker can supply a malicious remote_url that is passed directly to hashicorp/go-getter v1.7.5 without validation. The library honors the X-Terraform-Get redirect header and reads ~/.netrc credentials, enabling local file read and credential exfiltration. Terrascan was archived in August 2023, and no patch will be released.
Critical Impact
Unauthenticated attackers can read local files and steal .netrc credentials from any Terrascan server instance, which binds to 0.0.0.0 with no authentication.
Affected Products
- Tenable Terrascan v1.18.3
- Tenable Terrascan versions prior to v1.18.3
- Terrascan deployments running in server mode (terrascan server)
Discovery Timeline
- 2026-05-19 - CVE-2026-47357 published to NVD
- 2026-05-20 - Last updated in NVD database
Technical Details for CVE-2026-47357
Vulnerability Analysis
The vulnerability resides in Terrascan's remote scan API handler. When a client submits a POST request to /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan with remote_type set to "http", the supplied remote_url is forwarded to the hashicorp/go-getter library without sanitization. Go-getter's HttpGetter implements support for the X-Terraform-Get response header, which instructs the client to fetch content from an alternate location. An attacker-controlled server returns this header pointing to a file:// URI, redirecting the fetch to local filesystem paths. The same HttpGetter initializes with Netrc: true, causing it to parse ~/.netrc on every request and transmit stored credentials to attacker-controlled hostnames over HTTP. The Terrascan server binds to 0.0.0.0 and exposes the endpoint with no authentication mechanism. CWE-918 (SSRF) and CWE-73 (External Control of File Name or Path) both apply.
Root Cause
The root cause is the absence of URL validation before passing user-controlled input to a downloader library that supports protocol-switching redirects and automatic credential lookup. Terrascan trusts the remote_url parameter and relies on go-getter defaults that were never intended for untrusted input.
Attack Vector
An unauthenticated attacker sends an HTTP POST to the exposed Terrascan server with remote_url pointing to a host they control. The attacker's server responds with an X-Terraform-Get: file:///etc/passwd header, causing Terrascan to read and process local files. In a separate scenario, the attacker observes inbound HTTP requests from Terrascan and harvests .netrc credentials transmitted in the Authorization header.
// Code example not available - see GitHub Terrascan Repository for source details
// Reference: https://github.com/tenable/terrascan
Detection Methods for CVE-2026-47357
Indicators of Compromise
- Outbound HTTP requests from Terrascan hosts to unknown external domains containing Authorization headers sourced from .netrc.
- Inbound POST requests to /v1/*/remote/dir/scan originating from untrusted networks.
- Terrascan process accessing sensitive local files such as /etc/passwd, SSH keys, or cloud credential files outside expected scan directories.
Detection Strategies
- Inspect HTTP access logs on Terrascan servers for POST requests to the /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan endpoint with external remote_url values.
- Deploy egress filtering and alert on Terrascan host connections to non-allowlisted destinations.
- Monitor for file:// scheme references in Terrascan request payloads and downstream fetch operations.
Monitoring Recommendations
- Enable network flow logging on hosts running terrascan server and correlate inbound API traffic with outbound fetch behavior.
- Audit .netrc files on Terrascan systems and remove unnecessary stored credentials.
- Alert on any Terrascan instance exposed on 0.0.0.0 to public or untrusted network segments.
How to Mitigate CVE-2026-47357
Immediate Actions Required
- Stop running Terrascan in server mode (terrascan server) on any host reachable from untrusted networks.
- Migrate to actively maintained Infrastructure-as-Code scanners such as Checkov, tfsec, or KICS, since Terrascan is archived.
- Remove credentials from ~/.netrc on hosts that previously ran Terrascan in server mode and rotate any potentially exposed secrets.
Patch Information
No patch will be released. Tenable archived the Terrascan repository in August 2023. Users must decommission Terrascan or accept the risk. Refer to the GitHub Terrascan Repository for the archival notice.
Workarounds
- Bind Terrascan exclusively to 127.0.0.1 and front it with an authenticating reverse proxy if the server mode must remain in use.
- Restrict the Terrascan host with strict egress firewall rules that block all outbound traffic except to required Git or registry endpoints.
- Run Terrascan only as a CLI tool against trusted local IaC files, avoiding the HTTP API entirely.
# Configuration example: restrict Terrascan to localhost and block egress
# Bind server to loopback only
terrascan server --host 127.0.0.1 --port 9010
# Example iptables egress restriction
iptables -A OUTPUT -m owner --uid-owner terrascan -d 10.0.0.0/8 -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner terrascan -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
