VULNpocalypse
LowVulnerabilityPatch available

Palo Alto Networks discloses Checkov SSRF flaw CVE-2026-0323

Palo Alto Networks says Checkov before 3.4.2 has an SSRF flaw, CVE-2026-0323; upgrade to 3.4.2 or later if external module downloads are on.

Published
Fixed in
Checkov by Prisma Cloud 3.4.2 or later
Exploitation
No, Palo Alto Networks says it is not aware of any malicious exploitation

What happened

According to the Palo Alto Networks PSIRT advisory, published on 2026-11-11, CVE-2026-0323 is a server-side request forgery (SSRF) vulnerability in Checkov by Prisma Cloud. Palo Alto Networks says it lets a local unauthenticated user make unauthorized network requests from the host to internal services. The vendor classifies the weakness as CWE-918.

Palo Alto Networks rates the issue Severity LOW with a suggested urgency of MODERATE. It lists CVSS-BT 1.1 and CVSS-B 4.8. The advisory says the issue was discovered externally and credits James Golovich and Sreejith Gopinath. The advisory is the only source for this story, so nothing here has been independently verified.

On exploitation, Palo Alto Networks says it is not aware of any malicious exploitation of this issue. The advisory does not describe which internal services could be reached or give technical exploit details; these are not confirmed. No NVD record was among the sources reviewed, so NVD data is not confirmed here.

Am I affected?

Per Palo Alto Networks, the issue applies only to Checkov deployments that are configured to download external Terraform modules and that scan Terraform configurations from untrusted sources. The advisory says to check for either of these settings:

  • the --download-external-modules true command-line option
  • download-external-modules: true in your Checkov configuration files

If either is present, the advisory says the deployment is affected.

For versions, the advisory’s solution table lists Checkov by Prisma Cloud 2.0.1018 through 3.4.1 as affected and 3.4.2 or later as unaffected. Its CPE section instead lists versions from 3.4.0 up to but excluding 3.4.2. The two ranges differ, so the exact lower bound is not confirmed; treat anything below 3.4.2 as in scope.

The advisory also says the Checkov integration in Prisma Cloud is upgraded automatically when new versions become available.

What to do now

  1. Check whether your Checkov runs use --download-external-modules true or download-external-modules: true in a configuration file.
  2. Upgrade Checkov by Prisma Cloud to 3.4.2 or later, as the vendor recommends.
  3. If you cannot upgrade yet, the vendor’s workaround is to avoid running Checkov over untrusted content.
  4. Also per the vendor, pass configuration explicitly through a trusted configuration file instead of letting it be auto-loaded from the scanned directory.
  5. Watch the vendor advisory for updates. At the time of writing it shows only the initial publication on 2026-11-11.

Sources