CVE-2026-0311: CWE-918 Server-Side Request Forgery (SSRF) in Palo Alto Networks Checkov by Prisma Cloud

This vulnerability (CWE-918) in Palo Alto Networks Checkov by Prisma Cloud enables a local unauthenticated attacker to perform server-side request forgery (SSRF). This means the attacker can coerce the vulnerable application to send unauthorized network requests to internal services, potentially bypassing network access controls. The affected versions are all releases from 0 up to but excluding 3.2.533. The CVSS 4.0 vector indicates low attack complexity and no privileges required, but user interaction is needed. The impact is limited to unauthorized network requests with low severity.

An attacker with local access but no authentication can cause the vulnerable application to send network requests to internal services that may not be directly accessible otherwise. This could lead to information disclosure or interaction with internal systems. However, the overall severity is low, and there are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is referenced, users should monitor Palo Alto Networks advisories for updates. Until a fix is available, restrict local access to trusted users and consider network-level controls to limit unintended internal requests.