PALO ALTO Security Advisory
Published Date: Not specified
CVE: CVE-2026-0311
Advisory Summary
## 🔎 Title: CVE-2026-0311 Checkov by Prisma Cloud — Server-Side Request Forgery (SSRF) (Severity: LOW)
🧠 What happened?
Palo Alto Networks disclosed CVE-2026-0311, an SSRF vulnerability impacting Checkov when used through Prisma Cloud. SSRF can enable an attacker to coerce the server-side application to make requests to unintended internal or external destinations, potentially exposing internal services or metadata depending on network reachability and request handling.
- SSRF chains are often leveraged as stepping stones toward broader compromise (e.g., discovery of internal endpoints).
- Cloud security tooling (like Checkov/Prisma Cloud integrations) may run in high-trust environments, increasing blast radius if abused.
- “LOW” severity typically indicates constrained conditions (e.g., auth gating, limited reachability, or specific input paths), but real-world configurations can vary.
- Environments that automate scanning (CI/CD, IaC pipelines) and allow untrusted input into scanning workflows.
- Instances where Prisma Cloud integrations are connected to networks with access to internal-only services.
- Lack of monitoring for unexpected outbound connections from the scanning/orchestrating components.
🧩 Actionable recommendations
1. Identify exposure: Confirm whether your Prisma Cloud + Checkov deployment includes the affected component/version and whether the vulnerable request path is reachable.
2. Apply vendor guidance: Upgrade to the fixed version (or apply the mitigation) as specified in the advisory.
3. Harden network egress: Restrict outbound connectivity from Prisma Cloud / Checkov execution hosts to the minimum required destinations to reduce SSRF impact.
4. Monitor and alert: Create detection for unusual outbound requests (domains/IPs, internal RFC1918 targets, metadata endpoints) originating from scanning infrastructure.
🔐 Security patch / advisory reference
-0311
Reference: Vendor Advisory