Server-Side Request Forgery Vulnerability in Terrascan by Tenable

CVE-2026-47356

What is CVE-2026-47356?

Terrascan versions 1.18.3 and earlier are susceptible to a Server-Side Request Forgery vulnerability through the webhook_url parameter found in the file scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/local/file/scan). When operating in server mode, an unauthenticated remote attacker can supply a malicious URL through the webhook_url multipart form parameter. This allows the attacker to receive the complete scan results in JSON format, along with the attacker-specifically provided webhook_token sent as a Bearer token in the Authorization header. Furthermore, the HTTP client used in this scenario is designed to retry upon failure, potentially amplifying the risk. It is important to note that Terrascan was archived in August 2023, and no patches will be forthcoming to address this vulnerability.

References