CVE-2026-47358

When Terrascan runs in server mode, it processes uploaded ARM or CloudFormation templates, resolving external URLs contained in fields such as templateLink.uri, parametersLink.uri (ARM) or TemplateURL (CloudFormation). The hashicorp/go-getter library is used to fetch resources with all default detectors enabled, including FileDetector. An attacker can upload a template pointing to an attacker-controlled URL or directly use the file:// scheme, which — without requiring an X-Terraform-Get redirect — enables reading files from the server's local file system. Since the service requires no authentication, the attack can be conducted by any remote, unauthenticated user with network access to the listening port.

An attacker can force the server to execute requests to arbitrary internal or external resources (SSRF), and thanks to support for the file:// scheme — read any files from the server's file system (e.g., private keys, configuration data, secrets). Compromise of internal system confidentiality (SC:H) and direct leakage of local data constitute a serious security threat to the environment in which Terrascan is running.

The vendor archived the Terrascan project in August 2023 and will not release any patches. It is recommended to immediately stop using Terrascan in server mode in network-accessible environments. If continued use is necessary, restrict network access to the service exclusively to trusted hosts (firewall, ACL lists), implement authentication at the reverse proxy level, and consider migrating to an actively maintained alternative IaC analysis tool.

Tenable Terrascan version 1.18.3 and all earlier versions running in server mode (terrascan server). The issue affects deployments processing ARM or CloudFormation templates with external URL references.