CVE-2026-0311

Executive Summary

CVE-2026-0311 is a server-side request forgery (SSRF) vulnerability in Palo Alto Networks Checkov, a static code analysis tool distributed by Prisma Cloud. The flaw allows a local, unauthenticated user to induce the affected component to issue unauthorized network requests from the host toward internal services. Because the vulnerability is local in nature and no public proof-of-concept, patch, or exploitation evidence currently exists, the immediate enterprise risk is assessed as moderate, though environments running Checkov on shared or multi-tenant hosts face meaningful internal-network reconnaissance and lateral-movement exposure.

Technical Analysis

The vulnerability is classified under CWE-918 (Server-Side Request Forgery). In an SSRF condition, an application accepts input that influences a network request destination and fails to sufficiently restrict that destination. The result is that the server-side component—here, Checkov running on a host—can be coerced into sending requests to resources that the requesting user would not normally be able to reach directly, most notably internal services bound to loopback or private network ranges.

The NVD description states that the issue is triggered by "a local unauthenticated user," which is a notable characteristic for an SSRF finding. Rather than a remote attacker delivering a malicious payload over the network, the threat model assumes the adversary already has the ability to execute or supply input to Checkov locally on the host. This places the attacker in a position to influence whatever request-generating behavior Checkov performs and to redirect it toward internal endpoints. The precise input vector, the component within Checkov that performs the request, and the exact parsing logic are not disclosed in the available CNA title or NVD description; therefore those implementation specifics cannot be asserted here.

The attack surface is the local host running Checkov. Checkov is a widely used infrastructure-as-code and policy-as-code scanner, and deployments commonly run it inside CI/CD pipelines, build workers, and developer workstations. Any of these contexts where an unprivileged local actor can reach the Checkov execution path is theoretically in scope. The unauthenticated nature of the access requirement is significant: the attacker does not need valid credentials to the host's application layer, only local execution or input capability.

The core defensive failure represented by CWE-918 is the absence of adequate destination validation—allowlisting, blocking of loopback and link-local addresses, and resolution checks that prevent DNS rebinding or redirect-based bypass. Because the description does not enumerate the specific missing control, the weakness is best characterized at the class level: request targets derived from attacker-influenced input are not constrained to trusted destinations.

No CVSS vector is provided in the source data. The vector shown in the metadata above is a representative construction consistent with a local, unauthenticated confidentiality-impacting SSRF (AV:L, PR:N, UI:N, C:H); it should be treated as an analytical placeholder rather than an authoritative vendor score, since the official score is N/A.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-0311. The following attack chain is therefore inferred strictly from the vulnerability class (CWE-918) and the NVD description, and does not assert any specific Checkov function name, endpoint, or parameter.

1. Reconnaissance / target identification. The attacker obtains a foothold as a local user on a host that runs Checkov. This might be a developer workstation, a build agent, or a shared CI runner. The attacker identifies that Checkov is present and that they can influence the input it processes (for example, by supplying content that Checkov scans). No authentication to Checkov itself is required, matching the "local unauthenticated user" characterization.

2. Triggering the flaw class. The attacker supplies crafted input such that a network request generated during Checkov's processing is directed to an attacker-chosen destination. In SSRF, the classic trigger is user-controllable input that becomes a request URL or host. The description does not disclose which input this is, so the precise triggering mechanism is unknown; the operative weakness is that request destinations are not adequately restricted.

3. Payload / execution method (class level). Using the influenced request, the attacker aims the outbound connection at internal services—for example, services listening on loopback or RFC1918 ranges that the local user could not otherwise reach. This is the essence of SSRF: abusing the host's network position to reach resources beyond the attacker's direct reach. Specific payload formats, target ports, and service fingerprints cannot be stated without additional technical detail.

4. Post-exploitation impact. Successful exploitation yields unauthorized network requests from the host to internal services. Depending on what those internal services expose, this can enable internal service discovery, fingerprinting, metadata retrieval, or interaction with internal APIs. In cloud and container environments, SSRF is frequently chained toward instance metadata endpoints, though such a chain is not documented for this CVE and is noted only as a well-known SSRF consequence pattern.

Because the vulnerability is local and unauthenticated rather than remote, exploitation requires pre-existing local access. This constraint meaningfully reduces remote attack-surface exposure while still representing a credible privileged-network-pivot technique for an attacker who already holds a local foothold.

Impact Assessment

The primary impact is unauthorized network access from the host into internal services, which maps to a confidentiality-oriented outcome. The representative vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) implies:

• Attack Vector (Local): the attacker must be positioned locally on the host, limiting remote exploitation.
• Privileges Required (None): no authentication to Checkov is needed, lowering the bar once local access exists.
• User Interaction (None): no victim action beyond normal processing of attacker-influenced input is required.
• Scope (Unchanged): scoring assumes impact confined to the vulnerable component's security authority.
• Confidentiality (High): the core impact is unauthorized access to internal service data/responses.
• Integrity / Availability (None): no documented data modification or denial of service.

Business impact: Organizations running Checkov on build servers or shared runners face internal-network reconnaissance risk. In CI/CD contexts, a compromised runner could leverage this to probe adjacent internal services, potentially reaching control planes, artifact stores, or metadata services. Blast radius is bounded by the network position of the host running Checkov and the reachability of internal services from that host. Environments with flat internal networks and many co-located services are the most exposed. Given the absence of a KEV listing and an EPSS score of 0.00107 (1.1% percentile), active exploitation is currently unlikely, but the low EPSS should not be read as low inherent severity for high-value internal networks.

Detection Guidance

Sigma Rule

title: Potential Checkov SSRF Internal Network Requests (CVE-2026-0311)
id: 3f6a9c2e-1b47-4d9a-8e21-7c0a5b2d9f10
status: experimental
description: Detects Checkov processes making outbound requests to internal/loopback services, consistent with SSRF (CWE-918).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-0311
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: network_connection
  product: windows
detection:
  selection_proc:
    Image|endswith:
      - '\checkov.exe'
      - '\checkov'
  selection_dest:
    DestinationIp|cidr:
      - '127.0.0.0/8'
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '169.254.0.0/16'
  condition: selection_proc and selection_dest
falsepositives:
  - Legitimate Checkov policy modules that contact internal registries with intended destinations
level: medium
tags:
  - attack.t1190
  - cwe.918

YARA Rule

rule CVE_2026_0311_Checkov_SSRF_Indicator
{
    meta:
        description = "Heuristic indicator for Checkov SSRF-related configuration/input strings (CVE-2026-0311)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-0311"
        severity = "medium"

    strings:
        $ssrf1 = "http://127.0.0.1" ascii nocase
        $ssrf2 = "http://localhost" ascii nocase
        $ssrf3 = "http://169.254.169.254" ascii nocase
        $ssrf4 = "metadata.google.internal" ascii nocase
        $ckv1  = "checkov" ascii nocase

    condition:
        $ckv1 and any of ($ssrf*)
}

Suricata IDS Rule

alert http $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-0311 Checkov SSRF Attempt to Internal Service"; flow:to_server,established; http.header; content:"Host"; nocase; pcre:"/Host\x3a\s*(127\.0\.0\.1|localhost|169\.254\.169\.254)/i"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-recon; reference:cve,2026-0311; sid:20260311; rev:1;)

Elastic Detection

network where process.name : "checkov*" and
  destination.ip : ("127.0.0.0/8" or "10.0.0.0/8" or "172.16.0.0/12" or "192.168.0.0/16" or "169.254.0.0/16") and
  not destination.ip : "0.0.0.0"

Splunk SPL Query

index=network OR index=endpoint (process_name="checkov" OR process_name="checkov.exe")
| where match(dest_ip, "^(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.)")
| stats count values(dest_ip) as internal_targets values(dest_port) as ports by host process_name
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="checkov,ssrf,cve-2026-0311,">
  <rule id="100311" level="10">
    <if_sid>1002</if_sid>
    <field name="command">checkov</field>
    <match>127.0.0.1|localhost|169.254.169.254|10\.|192\.168\.|172\.1[6-9]\.</match>
    <description>CVE-2026-0311: Possible Checkov SSRF to internal service</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_918,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Isolate hosts that run Checkov so that outbound traffic to loopback and internal RFC1918 ranges from the Checkov process is blocked by host or network egress policy. Implement egress allowlisting that denies destination addresses of 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.0.0/16 for the Checkov process.
   • Restrict local access to the Checkov execution path so that only trusted build identities can invoke or supply input to it. Because exploitation requires a local unauthenticated user, reducing who can run Checkov on shared hosts is an effective compensating control.
   • Run Checkov in a sandboxed or ephemeral container with a minimal network namespace, removing reachability to sensitive internal services.
   • Monitor for the detection signatures in this report and alert on Checkov-driven requests to internal address space.

2. Patch / upgrade steps.

   • No vendor advisory, patch reference, or fixed version is currently available. Monitor the Palo Alto Networks security advisories and the Checkov project release channels for an official fix. When a patched version is published, test it in a non-production environment and deploy promptly, prioritizing hosts that run Checkov on shared or multi-tenant infrastructure.

3. Long-term hardening.

   • Adopt a network segmentation model that prevents CI/CD runners and scanners from directly reaching sensitive internal services.
   • Enforce egress filtering and metadata service protections (for example, requiring authentication or additional hops for cloud instance metadata) so that any future SSRF weakness cannot pivot to credential-bearing endpoints.
   • Apply the principle of least privilege to build identities and reduce the value of any local foothold on scanner hosts.
   • Integrate destination-validation review into secure SDLC practices for request-generating code, targeting CWE-918 anti-patterns.

References

• NVD — CVE-2026-0311: https://nvd.nist.gov/vuln/detail/CVE-2026-0311
• MITRE CWE-918 (Server-Side Request Forgery): https://cwe.mitre.org/data/definitions/918.html
• Palo Alto Networks Security Advisories (monitor for vendor advisory): https://security.paloaltonetworks.com/
• Checkov by Prisma Cloud (project release notes and advisories): https://github.com/bridgecrewio/checkov/releases
• CISA Known Exploited Vulnerabilities Catalog (current status: not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog