CVE-2026-47356 describes an SSRF vulnerability in Tenable's Terrascan when operated in server mode. The vulnerability arises from the webhook_url multipart form parameter in the POST /v1/{iac}/{iacVersion}/{cloud}/local/file/scan endpoint, which accepts an attacker-controlled URL. After scanning, Terrascan sends an HTTP POST request containing full scan results as JSON to this URL, including the webhook_token as a Bearer token in the Authorization header. The HTTP client retries up to 10 times on failure. The server mode binds to 0.0.0.0 and lacks authentication, allowing unauthenticated remote attackers to exploit this SSRF. Since Terrascan was archived in August 2023, no official fix or patch will be provided.

An unauthenticated remote attacker can exploit this SSRF vulnerability to cause Terrascan to send sensitive scan results and authorization tokens to attacker-controlled endpoints. This can lead to unauthorized disclosure of potentially sensitive information contained in scan results. The vulnerability does not impact integrity or availability but has a high confidentiality impact. There are no known exploits in the wild as of the published date.

No official patch or fix will be released as Terrascan was archived in August 2023. Users should discontinue use of Terrascan in server mode or restrict network access to the Terrascan server to trusted users only. Avoid running Terrascan server mode bound to 0.0.0.0 without authentication. Consider migrating to alternative tools that are actively maintained and patched.