CVE-2026-47357 Server-side request forgery in Terrascan
Unauthenticated attackers can exploit SSRF in Terrascan server mode to read local files and steal credentials via netrc exposure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-47357?
CVE-2026-47357 is a critical server-side request forgery vulnerability in tenable Terrascan, published on 19 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in the remote directory scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan) when running in server mode. An unauthenticated remote attacker can supply an attacker-controlled HTTP URL as remote_url with remote_type set to "http". The URL is passed directly to hashicorp/go-getter (v1.7.5) without validation. Go-getter's HttpGetter supports the X-Terraform-Get response header, allowing the attacker's server to redirect the download to a file:// URL, enabling local file read. Additionally, HttpGetter has Netrc set to true, causing it to read ~/.netrc and send stored credentials to attacker-controlled hostnames. This affects deployments running terrascan in server mode (terrascan server), which binds to 0.0.0.0 with no authentication. Note: Terrascan was archived in August 2023 and no patch will be released.
Which versions are affected by CVE-2026-47357?
It affects 1 product.
Products include Tenable Terrascan.
How do I fix CVE-2026-47357?
No fix has been published for CVE-2026-47357 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-47357 being exploited?
There is no known exploitation of CVE-2026-47357 in the wild and no public exploit code.
Other vulnerabilities in tenable Terrascan
Sources
Also known as GHSA-p747-w96h-fwcj.