CVE-2026-47358 Overview
CVE-2026-47358 is a Server-Side Request Forgery (SSRF) vulnerability in Tenable Terrascan v1.18.3 and prior. The flaw exists in how Terrascan resolves external URLs referenced within uploaded Infrastructure-as-Code (IaC) templates when running in server mode. An unauthenticated remote attacker can submit ARM or CloudFormation templates that reference attacker-controlled URLs, causing the server to fetch those URLs. Because the underlying hashicorp/go-getter library enables FileDetector by default, file:// URLs are directly usable, enabling arbitrary local file read. Terrascan was archived in August 2023, and no patch will be released [CWE-918, CWE-73].
Critical Impact
Unauthenticated attackers can read arbitrary local files and trigger server-side requests against internal resources from any Terrascan server-mode deployment exposed on the network.
Affected Products
- Tenable Terrascan v1.18.3
- Tenable Terrascan versions prior to v1.18.3
- Deployments running terrascan server (binds to 0.0.0.0 with no authentication)
Discovery Timeline
- 2026-05-19 - CVE-2026-47358 published to NVD
- 2026-05-20 - Last updated in NVD database
Technical Details for CVE-2026-47358
Vulnerability Analysis
Terrascan operates as an IaC static analysis tool that can run as a long-lived HTTP service via terrascan server. The server endpoint accepts uploaded templates for scanning and parses them to identify misconfigurations. During parsing of ARM templates and AWS CloudFormation templates, Terrascan resolves external resource references using hashicorp/go-getter with all default detectors enabled.
The issue spans two CWE classifications: External Control of File Name or Path [CWE-73] and Server-Side Request Forgery [CWE-918]. An attacker controls the URL Terrascan fetches, and the fetch occurs server-side without authentication. Unlike the SSRF reachable through the remote scan endpoint, this code path does not require an X-Terraform-Get redirect, which makes exploitation more direct.
Because Terrascan was archived in August 2023, no vendor fix will ship. Operators must remove the exposure rather than wait for a patch.
Root Cause
The root cause is unsafe URL resolution during template parsing. Terrascan passes user-supplied URI fields to go-getter with the default detector set, which includes FileDetector. FileDetector accepts file:// schemes and resolves them to local filesystem paths. The parser does not validate the scheme, host, or destination of URI fields before delegating retrieval to go-getter.
Attack Vector
An unauthenticated attacker submits a malicious template to the Terrascan server. For ARM templates, the attacker populates a templateLink.uri or parametersLink.uri field. For CloudFormation templates, the attacker sets the TemplateURL field of an AWS::CloudFormation::Stack resource. The value points to an attacker-controlled HTTP endpoint to pivot internally, or to a file:// URL such as file:///etc/passwd to read local files. Terrascan fetches the URL server-side and incorporates the response into its processing.
The vulnerability is described in prose because no verified public proof-of-concept code is published with the advisory. Refer to the GitHub Terrascan Repository for source-level context on the affected parsers.
Detection Methods for CVE-2026-47358
Indicators of Compromise
- HTTP requests to the Terrascan server endpoint containing ARM templates with templateLink.uri or parametersLink.uri fields referencing external or file:// URLs.
- HTTP requests containing CloudFormation AWS::CloudFormation::Stack resources with a TemplateURL value pointing to attacker-controlled hosts.
- Outbound connections from Terrascan hosts to unexpected external IPs or internal management addresses immediately after a template upload.
- Terrascan process activity reading sensitive local files such as /etc/passwd, /proc/self/environ, or cloud metadata files.
Detection Strategies
- Inspect web access logs for POST requests to Terrascan server endpoints and parse uploaded payloads for URI fields containing file://, internal RFC1918 addresses, or cloud metadata endpoints such as 169.254.169.254.
- Monitor egress network traffic from hosts running terrascan server for connections to destinations outside an approved allowlist.
- Alert on Terrascan process file reads outside its working directory using endpoint telemetry.
Monitoring Recommendations
- Forward Terrascan host process, file, and network telemetry into a central data lake for correlation across template uploads and outbound fetches.
- Baseline normal Terrascan outbound destinations and alert on deviations, particularly requests to link-local addresses.
- Track exposure of port 9010 (Terrascan default) on 0.0.0.0 interfaces in attack surface inventories.
How to Mitigate CVE-2026-47358
Immediate Actions Required
- Stop running terrascan server mode on any host reachable from untrusted networks. The service binds to 0.0.0.0 with no authentication by default.
- Migrate scanning workflows to the Terrascan CLI invoked against trusted local templates, or replace Terrascan with a maintained IaC scanner.
- Restrict egress from any remaining Terrascan hosts so they cannot reach internal management interfaces, cloud metadata services, or arbitrary external hosts.
- Audit historical logs for prior exploitation attempts using the indicators listed above.
Patch Information
No patch is available. Tenable archived the Terrascan project in August 2023, and the maintainers will not release a fix for CVE-2026-47358. The only durable remediation is to retire terrascan server deployments and select a supported alternative. See the GitHub Terrascan Repository for the archive notice.
Workarounds
- Place Terrascan server behind a reverse proxy that enforces authentication and rejects requests containing templateLink, parametersLink, or TemplateURL fields with non-allowlisted schemes.
- Run Terrascan inside a network namespace or container with no outbound internet access and read-only access to its working directory only.
- Bind the Terrascan listener to 127.0.0.1 and tunnel access through an authenticated jump host instead of exposing 0.0.0.0.
- Strip or validate file:// and external http(s):// URIs from templates before submission using an upstream sanitizer.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
