PT-2026-41954 · Hashicorp+1 · Go-Getter+1

Published 2026-05-19 · Updated 2026-05-19 · CVE-2026-47358

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Terrascan versions prior to 1.18.4

Description Terrascan is susceptible to Server-Side Request Forgery (SSRF) when operating in server mode. The issue occurs during the parsing of uploaded Infrastructure as Code (IaC) templates, specifically ARM or CloudFormation templates, where external URLs are resolved using the hashicorp/go-getter library with the FileDetector enabled. An unauthenticated remote attacker can upload templates containing a templateLink.uri or parametersLink.uri field in ARM templates, or an AWS::CloudFormation::Stack TemplateURL field in CloudFormation templates, pointing to a malicious URL. This allows the server to fetch the attacker-controlled URL and enables local file read via file:// URLs without requiring redirects. This affects deployments where the server binds to 0.0.0.0 without authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-73

CWE-918

CWE-610

Related Identifiers

CVE-2026-47358

Affected Products

Terrascan

Go-Getter

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-47358 · Security Note
• https://github.com/tenable/terrascan · Note
• https://t.me/CVEtracker/54264 · Telegram Post
• https://twitter.com/UpwindMDR/status/2056871987222315036 · Twitter Post
• https://twitter.com/CVEnew/status/2056870212910121375 · Twitter Post