PALO ALTO Security Advisory
Published Date: Not specified
CVE: CVE-2026-0312
Advisory Summary
🔎 📌 CVE-2026-0312 Checkov by Prisma Cloud — Path Traversal (Severity: MEDIUM)
- Prisma Cloud’s Checkov component is affected by path traversal behavior that could allow an attacker to access or influence files outside the intended directory through crafted inputs.
- Impact is typically constrained to environments where the vulnerable code path is reachable (e.g., CI/CD scanning workflows, config/code ingestion flows, or any integration that processes attacker-influenced paths).
- Even at MEDIUM severity, path traversal issues can become high-impact when paired with:
- weak file permissions,
- exposed build artifacts/logs,
- or scenarios where scan targets are not fully trusted (e.g., external PRs, shared repos).
- For data center and infrastructure buyers, this is a reminder that DevSecOps tooling supply-chain paths can be an operational risk, not just an app-layer risk.
- CI/CD runners and scanning pipelines: confirm who can trigger scans and whether untrusted inputs can reach Checkov.
- File system exposure: validate that the scanning service account has least-privilege access.
- Network segmentation: ensure scanning components can’t reach sensitive internal endpoints unless strictly required.
- Logging & artifacts: assess whether traversal could expose secrets embedded in build logs or temporary files.
- restrict scan triggers to trusted branches/users,
- treat external PRs as untrusted and isolate scanning execution.
- run scanners with a non-privileged service account,
- use containers/sandboxing with locked-down mounts and read-only where possible.
- alert on suspicious path patterns (e.g., ../-style traversal attempts) in pipeline logs.
- confirm you’re not exposing Checkov endpoints or file-processing hooks in a way that allows user-controlled paths.
🔗
Reference: Vendor Advisory