# CVE-2026-0303: Palo Alto Networks Checkov arbitrary code execution via auto-loaded configuration

Source: https://junglewise.ai/threats/cve-2026-0303-palo-alto-networks-checkov-arbitrary-code-execution-via-auto  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-0303 · Severity: info · CVSS 2.4 · Published 2026-09-10

Checkov by Prisma Cloud is an infrastructure-as-code (IaC) scanning tool used by organizations to validate cloud configurations and detect misconfigurations. The vulnerability allows arbitrary code execution when Checkov processes an attacker-controlled configuration file in a scanned directory, potentially compromising systems that scan untrusted or shared code repositories.

Technologies: [Palo Alto Networks Checkov by Prisma Cloud](https://junglewise.ai/threats/technologies/checkov-by-prisma-cloud). Vendors: [Palo Alto Networks](https://junglewise.ai/threats/vendors/palo-alto-networks).

## Quick answers

**Is CVE-2026-0303 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0303 being exploited in the wild.

**How severe is CVE-2026-0303?** Informational severity, with a CVSS score of 2.4, published 10 September 2026.

**Which products and versions are affected?** Palo Alto Networks Checkov by Prisma Cloud 3.2.0 through 3.2.531.

**Is there a fix for CVE-2026-0303?** A patch was published on 2026-09-09: Fix available in version 3.2.532 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-0303 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-0303?** Check whether you run Palo Alto Networks Checkov by Prisma Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a code execution vulnerability stemming from untrusted control sphere inclusion (CWE-829). The root cause is Checkov's automatic loading of configuration files from the scanned directory without proper validation. The attack vector is local with low complexity—an attacker places a malicious configuration file in a directory that Checkov will scan, and when invoked without explicit trusted configuration, the tool auto-loads and executes the attacker's code. User interaction is passive (simply running the scan). The attack requires no authentication or special privileges. A patch is available in version 3.2.532 and later; users should upgrade immediately or avoid scanning untrusted content until patched.

## Affected products

- Palo Alto Networks Checkov by Prisma Cloud 3.2.0 through 3.2.531

## Timeline

- 2026-09-09: disclosed
- 2026-09-09: patched: Fix available in version 3.2.532 and later

## References

- [https://security.paloaltonetworks.com/CVE-2026-0303](https://security.paloaltonetworks.com/CVE-2026-0303)

## Related threats

- [Palo Alto Networks Checkov by Prisma Cloud SSRF](https://junglewise.ai/threats/cve-2026-0323-a-server-side-request-forgery-vulnerability-in-palo-alto-networks)
- [Palo Alto Networks Checkov OS command injection](https://junglewise.ai/threats/cve-2026-0302-palo-alto-networks-checkov-os-command-injection)