{"id":"CVE-2026-0323","kind":"vulnerability","aliases":["CVE-2026-0323"],"related":[],"title":"Checkov: local user can make server-side requests to internal services","description":"A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services.","summary":"Checkov, a Palo Alto Networks infrastructure-as-code scanner, has a server-side request forgery flaw. A local user with no login can make the host send network requests to internal services.","severity":"low","cvss":1.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["checkov","ci","package","python"],"not_affected_if":["single-user-machine"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-11T20:16:59+00:00","first_seen_at":"2026-11-11T20:28:52+00:00","triaged_at":"2026-11-11T20:30:25+00:00","updated_at":"2026-11-11T20:30:25+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T20:30:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Checkov: local user can make server-side requests to internal services","impact":"medium","summary":"Checkov, a Palo Alto Networks infrastructure-as-code scanner, has a server-side request forgery flaw. A local user with no login can make the host send network requests to internal services.","audience":"developers","category":"package","nicknames":[],"who_cares":["checkov","python","ci"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Host makes unauthorized requests to internal services","analyst_note":"Check the NVD entry and Palo Alto Networks advisory for affected Checkov versions, fixed release and whether a config option is required.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-user-machine"],"who_is_affected":"Teams that run Checkov on a shared host or CI runner where a local user without credentials could reach it. The sources do not list affected versions or configuration details. Developers who run it only on their own laptops are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000656,"input_tokens":4522,"output_tokens":407,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-0323':15A,18A '-2026':14A,17A 'alto':26B,66C 'checkov':1A,19B,23B,68C 'ci':20B 'cloud':71C 'code':31B 'cve':13A,16A 'enabl':72C 'flaw':40B 'forgeri':39B,62C 'host':50B,83C 'infrastructur':29B 'infrastructure-as-cod':28B 'intern':11A,55B,85C 'local':2A,42B,74C 'login':46B 'make':5A,48B,78C 'network':27B,52B,67C,80C 'packag':21B 'palo':25B,65C 'prisma':70C 'python':22B 'request':9A,38B,53B,61C,81C 'scanner':32B 'send':51B 'server':7A,36B,59C 'server-sid':6A,35B,58C 'servic':12A,56B,86C 'side':8A,37B,60C 'unauthent':75C 'unauthor':79C 'user':3A,43B,76C 'vulner':63C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Checkov on a shared host or CI runner where a local user without credentials could reach it. The sources do not list affected versions or configuration details. Developers who run it only on their own laptops are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["checkov","ci","low","package","python"],"campaign_type":null,"search_a":"'-0323':15A,18A '-2026':14A,17A 'checkov':1A 'cve':13A,16A 'intern':11A 'local':2A 'make':5A 'request':9A 'server':7A 'server-sid':6A 'servic':12A 'side':8A 'user':3A","search_b":"'alto':26B 'checkov':19B,23B 'ci':20B 'code':31B 'flaw':40B 'forgeri':39B 'host':50B 'infrastructur':29B 'infrastructure-as-cod':28B 'intern':55B 'local':42B 'login':46B 'make':48B 'network':27B,52B 'packag':21B 'palo':25B 'python':22B 'request':38B,53B 'scanner':32B 'send':51B 'server':36B 'server-sid':35B 'servic':56B 'side':37B 'user':43B","search_c":"'alto':66C 'checkov':68C 'cloud':71C 'enabl':72C 'forgeri':62C 'host':83C 'intern':85C 'local':74C 'make':78C 'network':67C,80C 'palo':65C 'prisma':70C 'request':61C,81C 'server':59C 'server-sid':58C 'servic':86C 'side':60C 'unauthent':75C 'unauthor':79C 'user':76C 'vulner':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T20:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber","cvss_by":"psirt@paloaltonetworks.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-0323","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0323","severity":null,"published_at":"2026-11-11T20:16:59+00:00","modified_at":"2026-11-11T20:16:59+00:00","first_seen_at":"2026-11-11T20:28:52+00:00","fetched_at":"2026-11-11T20:28:52+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}