Terrascan SSRF Vulnerability (CVE-2026-47356) Exposes Scan Results
The National Vulnerability Database has disclosed CVE-2026-47356, a high-severity Server-Side Request Forgery (SSRF) vulnerability in Terrascan v1.18.3 and prior. This flaw resides in the webhook_url parameter within the file scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/local/file/scan) when Terrascan operates in server mode. An unauthenticated remote attacker can exploit this by supplying an arbitrary URL as the webhook_url multipart form parameter.
Upon scanning an uploaded file, Terrascan will send an HTTP POST request to the attacker-controlled URL. This request includes the full scan results as a JSON body, along with any attacker-supplied webhook_token forwarded as a Bearer token in the Authorization header. The system’s retryable HTTP client will attempt delivery up to 10 times on failure, potentially increasing exposure. This vulnerability specifically impacts deployments running terrascan server, which binds to 0.0.0.0 without authentication.
Critically, Terrascan was archived in August 2023, meaning no official patch will be released for this vulnerability. Defenders must understand that this is a permanent flaw in unpatched versions, making immediate mitigation essential rather than awaiting a vendor fix.
What This Means For You
- If your organization uses Terrascan in server mode (terrascan server), you are exposed. This SSRF allows attackers to exfiltrate your Infrastructure-as-Code scan results, which often contain sensitive configuration details. Since no patch is coming, your only option is to decommission or isolate these vulnerable instances immediately. Review network configurations to ensure Terrascan servers are not exposed to untrusted networks.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-47356: Terrascan SSRF via webhook_url
title: CVE-2026-47356: Terrascan SSRF via webhook_url
id: scw-2026-05-19-ai-1
status: experimental
level: high
description: |
Detects the specific SSRF vulnerability in Terrascan (CVE-2026-47356) by looking for POST requests to the /v1/*/local/file/scan endpoint that include the 'webhook_url=' parameter. This allows unauthenticated attackers to control the destination of scan results.
author: SCW Feed Engine (AI-generated)
date: 2026-05-19
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-47356/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/v1/'
cs-method:
- 'POST'
cs-uri-query|contains:
- '/file/scan'
uri|contains:
- 'webhook_url='
selection_base:
cs-uri|contains:
- '/v1/'
cs-method:
- 'POST'
cs-uri-query|contains:
- '/file/scan'
selection_indicators:
uri|contains:
- 'webhook_url='
condition: selection_base AND selection_indicators
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-47356 | SSRF | Terrascan v1.18.3 and prior |
| CVE-2026-47356 | SSRF | webhook_url parameter |
| CVE-2026-47356 | SSRF | POST /v1/{iac}/{iacVersion}/{cloud}/local/file/scan endpoint |
| CVE-2026-47356 | Misconfiguration | Terrascan running in server mode (terrascan server) binding to 0.0.0.0 with no authentication |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 19, 2026 at 20:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-20240 — Denial of Service
CVE-2026-20240 — In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129,...
Splunk Enterprise, Cloud Vulnerability Exposes Session Cookies, Sensitive Data
CVE-2026-20239 — In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a...
CVE-2026-20238 — In Splunk AI Toolkit versions below 5.7.3, a low-privileged
CVE-2026-20238 — In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could access confidential data...