Palo Alto Networks Checkov SSRF Vulnerability Affects Versions 3.2.0 to 3.2.532

Palo Alto Networks PSIRT has disclosed CVE-2026-0311, a server-side request forgery vulnerability affecting its Checkov by Prisma Cloud product. This security flaw allows a local, unauthenticated user to initiate unauthorized network requests from the host machine to internal services. The advisory highlights the risk of internal network access without requiring authentication credentials from the attacker.

The vulnerability is assigned a Common Vulnerability Scoring System base score of 4.8, which Palo Alto Networks classifies as Low severity. The vector string indicates local access is required, along with user interaction, to exploit the issue. Despite the potential for internal data exposure, Palo Alto Networks states it is not aware of any malicious exploitation of this specific issue in the wild.

Technical Scope and Severity

The flaw exists in Checkov by Prisma Cloud versions starting from 3.2.0 and continuing up to, but not including, version 3.2.533. According to the official advisory, the CVSS v4.0 metrics reflect a base score of 4.8 and a temporal score of 1.1. The low temporal score suggests limited current exploitability or awareness. The vulnerability enables the forging of requests from the server to internal services, potentially bypassing network restrictions that would normally block external access.

Affected Software Versions

Organizations using Checkov by Prisma Cloud must verify their installed versions against the vulnerable range. Any installation running version 3.2.0 or later, but earlier than version 3.2.533, is considered vulnerable to CVE-2026-0311. The CPE identifier for the affected product is cpe:2.3:a:palo_alto_networks:checkov_by_prisma_cloud. Users should check their specific build numbers to determine if they fall within this window. No fixed version has been confirmed yet.

What should you do?

Until a fixed version is deployed, Palo Alto Networks advises users to avoid running Checkov over untrusted content. Administrators should also pass configuration explicitly via a trusted configuration file. This mitigation prevents the tool from auto-loading configuration from the scanned directory, which could trigger the server-side request forgery. Monitoring local network traffic for unusual internal requests may also help detect potential abuse.

What to do and how to stay safe: Palo Alto Networks

• Audit your environment to identify any installations of Checkov by Prisma Cloud running versions between 3.2.0 and 3.2.532.
• Immediately stop scanning untrusted or unknown code repositories with vulnerable versions of the tool to prevent exploitation.
• Configure Checkov to use explicit, trusted configuration files rather than allowing automatic configuration loading from scanned directories.
• Monitor internal network logs for unauthorized requests originating from hosts running the affected software versions.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-0311 and what does it affect?

CVE-2026-0311 is a server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma Cloud that allows local unauthenticated users to make unauthorized internal network requests.

Is there a patch available for this vulnerability?

No, a fixed version has not been released yet. Users must apply workarounds such as avoiding untrusted content until an update is provided.

What versions of Checkov are vulnerable to this flaw?

Versions 3.2.0 and later, up to but excluding version 3.2.533, are vulnerable to CVE-2026-0311 according to the Palo Alto Networks advisory.