PT-2026-41952 · Terrascan · Terrascan

Published 2026-05-19 · Updated 2026-05-19 · CVE-2026-47356

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Terrascan versions prior to 1.18.3

Description When running in server mode, the software is susceptible to Server-Side Request Forgery (SSRF), a flaw where an attacker can force the server to make requests to an unintended location. An unauthenticated remote attacker can provide an arbitrary URL through the webhook url multipart form parameter at the "POST /v1/{iac}/{iacVersion}/{cloud}/local/file/scan" endpoint. Upon completing a file scan, the server sends an HTTP POST request to the specified URL containing the scan results in a JSON body, including a webhook token as a Bearer token in the Authorization header. This issue affects deployments where the server binds to 0.0.0.0 without authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-47356

Affected Products

Terrascan

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-47356 · Security Note
• https://github.com/tenable/terrascan · Note
• https://twitter.com/UpwindMDR/status/2056871987222315036 · Twitter Post
• https://t.me/CVEtracker/54262 · Telegram Post
• https://twitter.com/CVEnew/status/2056870215003095094 · Twitter Post