Is CVE-2026-47358 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47358 being exploited in the wild.

How severe is CVE-2026-47358?

High severity, with a CVSS score of 7.5, published 19 May 2026.

Which products and versions are affected?

Tenable Terrascan v1.18.3 and prior.

Is there a fix for CVE-2026-47358?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-47358 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-47358?

Check whether you run Tenable Terrascan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47358: Tenable Terrascan SSRF and local file read in server mode

CVE-2026-47358 · Severity: high · CVSS 7.5 · Published 2026-05-19

Terrascan, a tool used to scan Infrastructure as Code (IaC) for security risks, contains a vulnerability when running in its server mode. An unauthenticated attacker can upload a malicious configuration file that forces the server to access internal resources or read local files. This could lead to the exposure of sensitive system information or internal network data. Because the project was archived in 2023, no official security patch will be released.

Technologies: Tenable Terrascan. Vendors: Tenable.

Quick answers

Is CVE-2026-47358 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47358 being exploited in the wild.
How severe is CVE-2026-47358?: High severity, with a CVSS score of 7.5, published 19 May 2026.
Which products and versions are affected?: Tenable Terrascan v1.18.3 and prior.
Is there a fix for CVE-2026-47358?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-47358 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47358?: Check whether you run Tenable Terrascan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Terrascan is vulnerable to Server-Side Request Forgery (SSRF) when running in server mode (terrascan server). The vulnerability exists in the parsing of ARM and CloudFormation templates, where external URLs in fields like templateLink.uri or TemplateURL are resolved using the hashicorp/go-getter library. Because default detectors including FileDetector are enabled, an unauthenticated remote attacker can use the file:// protocol to perform local file reads or target internal network services. The server binds to 0.0.0.0 by default with no authentication. As the project was archived in August 2023, no patch is available, and users are advised to avoid running the software in server mode or migrate to supported alternatives.

Affected products

Tenable Terrascan v1.18.3 and prior

Timeline

2023-08-01: other: Project archived by maintainer
2026-05-19: disclosed: Vulnerability published

References

https://github.com/tenable/terrascan

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.