CVE-2026-47357

The vulnerability exists in Terrascan's server mode (terrascan server), which by default listens on 0.0.0.0 without any authentication mechanism. An attacker sends a POST request to the /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan endpoint, providing an attacker-controlled HTTP address as the remote_url parameter value with remote_type set to 'http'. The URL is passed directly to the hashicorp/go-getter library (v1.7.5) without any validation. The go-getter library supports the X-Terraform-Get response header, which allows an attacker's server to redirect the download to a file:// address, enabling local file reading. Additionally, the HttpGetter component has the Netrc option enabled (true), so it reads the ~/.netrc file and sends the credentials stored in it to the attacker-controlled server.

An unauthenticated remote attacker can read arbitrary local files accessible to the Terrascan process and steal credentials (usernames, passwords, tokens) stored in the ~/.netrc file on the server, which may lead to further infrastructure security breaches.

No patch will be released — the Terrascan project was archived by Tenable in August 2023. It is recommended to immediately cease using Terrascan in server mode (especially in network-accessible environments), migrate to an alternative tool, and — if continued use is unavoidable — restrict access to Terrascan endpoints using firewall or network-level access control mechanisms (e.g., localhost only or VPN).

Tenable Terrascan v1.18.3 and all earlier versions running in server mode (terrascan server)