CVE-2026-0323 Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability
Description
A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services.
Product Status
| Versions | Affected | Unaffected |
|---|---|---|
| Checkov by Prisma Cloud | < 3.4.2 | >= 3.4.2 |
Required Configuration for Exposure
This issue is only applicable to Checkov deployments configured to download external Terraform modules and scanning Terraform configurations from untrusted sources.
To check if a Checkov deployment has external module downloading enabled:
- Check for the --download-external-modules true from command-line option.
- Check your Checkov configuration files for download-external-modules: true.
If any of these settings are present, your deployment is affected
Severity: LOW, Suggested Urgency: MODERATE
CVSS-BT: 1.1 / CVSS-B: 4.8 (CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:H/SI:H/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber)
Exploitation Status
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Weakness Type and Impact
CWE-918 Server-Side Request Forgery (SSRF)
CAPEC-664 Server Side Request Forgery
Solution
| Version | Minor Version | Suggested Solution |
|---|---|---|
| Checkov by Prisma Cloud | 2.0.1018 through 3.4.1 | Upgrade to 3.4.2 or later. |
Checkov integration in Prisma Cloud is upgraded automatically when new versions become available.
Workarounds and Mitigations
Until a fixed version is deployed, avoid running Checkov over untrusted content, and pass configuration explicitly via a trusted configuration file rather than allowing configuration to be auto-loaded from the scanned directory.
Acknowledgments
CPE Applicability
- cpe:2.3:a:palo_alto_networks:checkov_by_prisma_cloud:*:*:*:*:*:*:*:* is vulnerable from (including)3.4.0 and up to (excluding)3.4.2