CVE-2026-47357
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Terrascan v1.18.3 and prior are vulnerable to SSRF via the remote_url parameter in the remote directory scan endpoint in server mode. An unauthenticated attacker can supply an HTTP URL passed to go-getter without validation. Go-getter supports X-Terraform-Get header for redirect to file:// URL, enabling local file read. Additionally, ~/.netrc is read, potentially leaking credentials.
Risk Assessment
An attacker can read sensitive files and capture credentials from .netrc, leading to data leakage and further attacks.
Recommendation
Discontinue using Terrascan in server mode or replace it with another tool, as the project is archived and will not receive patches.
Other vulnerabilities in Terrascan
See all- CVE-2026-47358High
Terrascan v1.18.3 and prior are vulnerable to SSRF via external URL resolution in uploaded IaC templates when running in server mode. An unauthenticated attacker can upload a template with a field pointing to a controlled URL, causing server-side fetch. Local file read via file:// scheme is also possible.
- CVE-2026-47356High
Terrascan v1.18.3 and prior are vulnerable to SSRF via the webhook_url parameter in the file scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/local/file/scan) in server mode. An unauthenticated attacker can supply an arbitrary URL, and Terrascan sends scan results with the webhook token to that URL.
Original NVD description (English source)
Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in the remote directory scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan) when running in server mode. An unauthenticated remote attacker can supply an attacker-controlled HTTP URL as remote_url with remote_type set to "http". The URL is passed directly to hashicorp/go-getter (v1.7.5) without validation. Go-getter's HttpGetter supports the X-Terraform-Get response header, allowing the attacker's server to redirect the download to a file:// URL, enabling local file read. Additionally, HttpGetter has Netrc set to true, causing it to read ~/.netrc and send stored credentials to attacker-controlled hostnames. This affects deployments running terrascan in server mode (terrascan server), which binds to 0.0.0.0 with no authentication. Note: Terrascan was archived in August 2023 and no patch will be released.