CVE-2026-47356

🗓️ 19 May 2026 15:53:04Reported by tenableType

cve🔗 web.nvd.nist.gov👁 11 Views🌐 WEB

Terrascan in server mode is vulnerable to SSRF via webhook_url in the file scan endpoint; unauthenticated attacker can exfiltrate results to an attacker URL.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-47356	19 May 202615:53	–	attackerkb
Circl	CVE-2026-47356	19 May 202618:00	–	circl
CNNVD	terrascan 代码问题漏洞	19 May 202600:00	–	cnnvd
Cvelist	CVE-2026-47356	19 May 202615:53	–	cvelist
EUVD	EUVD-2026-30952	19 May 202615:53	–	euvd
NVD	CVE-2026-47356	19 May 202617:16	–	nvd
Positive Technologies	PT-2026-41952	19 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-47356	5 Jun 202619:21	–	redhatcve
Vulnrichment	CVE-2026-47356	19 May 202615:53	–	vulnrichment

NVD

Node

tenable terrascanRange≤1.18.3

[
  {
    "vendor": "tenable",
    "product": "Terrascan",
    "versions": [
      {
        "version": "0",
        "lessThanOrEqual": "1.18.3",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "affected"
  }
]

Source	Link
github	www.github.com/tenable/terrascan

Parameter	Position	Path	Description	CWE
webhook_url	request body	/v1/{iac}/{iacVersion}/{cloud}/local/file/scan	SSRF via webhook_url in file scan endpoint when running in server mode; attacker-controlled URL is fetched with scan results and Bearer token forwarded in Authorization header.	CWE-918
webhook_token	request body	/v1/{iac}/{iacVersion}/{cloud}/local/file/scan	SSRF via webhook_url in file scan endpoint when running in server mode; attacker-controlled URL is fetched with scan results and Bearer token forwarded in Authorization header.	CWE-918

20 May 2026 14:23Current

6Medium risk

Vulners AI Score6

CVSS 3.17.5 - 8.6

CVSS 48.7

EPSS0.00047

SSVC

CWE-918