CVE-2026-47357 describes an SSRF vulnerability in tenable Terrascan (v1.18.3 and prior) when running in server mode. The vulnerability arises from the remote_url parameter in the POST /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan endpoint, which accepts attacker-controlled HTTP URLs without validation. The URL is passed to hashicorp/go-getter (v1.7.5), whose HttpGetter supports the X-Terraform-Get header allowing redirection to file:// URLs, enabling local file reads. Additionally, go-getter's HttpGetter reads the ~/.netrc file and sends stored credentials to attacker-controlled hosts. Terrascan server mode listens on 0.0.0.0 with no authentication, making it accessible to unauthenticated remote attackers. Since Terrascan was archived in August 2023, no official fix or patch will be provided.

Successful exploitation allows unauthenticated remote attackers to perform SSRF attacks that can read local files on the server running Terrascan and potentially exfiltrate credentials stored in the ~/.netrc file. This leads to a confidentiality breach with high impact on sensitive data. The lack of authentication and binding to all network interfaces increases the attack surface. There are no known exploits in the wild as of the published date.

No official patch or fix is available because Terrascan was archived in August 2023. Users should discontinue use of Terrascan server mode or isolate it from untrusted networks to prevent exposure. Consider migrating to alternative tools that are actively maintained and do not have this vulnerability. Network-level controls such as firewall rules to restrict access to the Terrascan server may reduce risk but do not eliminate the underlying vulnerability.