Is CVE-2026-47357 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47357 being exploited in the wild.

How severe is CVE-2026-47357?

High severity, with a CVSS score of 7.5, published 19 May 2026.

Which products and versions are affected?

Tenable Terrascan v1.18.3 and prior.

Is there a fix for CVE-2026-47357?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-47357 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-47357?

Check whether you run Tenable Terrascan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47357: Tenable Terrascan SSRF and local file read in remote directory scan

CVE-2026-47357 · Severity: high · CVSS 7.5 · Published 2026-05-19

Terrascan, a tool used to scan Infrastructure as Code for security violations, contains a vulnerability in its server mode that allows unauthorized remote attackers to access sensitive local files. By sending a specially crafted request to the scanning service, an attacker can trick the system into reading internal configuration files or stealing stored credentials. This could lead to a full compromise of the server or the cloud environments it manages. Because the project is archived, no official security updates will be released.

Technologies: Tenable Terrascan. Vendors: Tenable.

Quick answers

Is CVE-2026-47357 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47357 being exploited in the wild.
How severe is CVE-2026-47357?: High severity, with a CVSS score of 7.5, published 19 May 2026.
Which products and versions are affected?: Tenable Terrascan v1.18.3 and prior.
Is there a fix for CVE-2026-47357?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-47357 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47357?: Check whether you run Tenable Terrascan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Terrascan's remote directory scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan) is vulnerable to Server-Side Request Forgery (SSRF) when running in server mode. An unauthenticated remote attacker can provide a malicious URL via the 'remote_url' parameter, which is passed without validation to the 'hashicorp/go-getter' library. By leveraging the 'X-Terraform-Get' response header, an attacker can force the server to redirect the request to a 'file://' URL, enabling local file disclosure. Furthermore, because 'go-getter' has 'Netrc' enabled by default, it may read and transmit credentials from the '~/.netrc' file to an attacker-controlled host. The project was archived in 2023 and no patch is available; users should avoid running Terrascan in server mode on untrusted networks.

Affected products

Tenable Terrascan v1.18.3 and prior

Timeline

2023-08-01: other: Project archived by maintainer
2026-05-19: disclosed: CVE published

References

https://github.com/tenable/terrascan

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.