PALO ALTO Security Advisory
Published Date: Not specified
CVE: CVE-2026-0303
Advisory Summary
⛳️ 📌 CVE-2026-0303 — Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File (Severity: LOW)
- CVE-2026-0303 affects Checkov (via Prisma Cloud) where code execution may be possible through an auto-loaded configuration file.
- The issue is classified as LOW severity, but it can still matter in environments where configuration files are attacker-influenced (e.g., compromised CI artifacts, writable shared repos, or misconfigured pipelines).
- Configuration-driven execution is a common escalation path in DevSecOps workflows.
- Prisma Cloud/Checkov users often run scans in CI/CD, containers, and ephemeral runners—making file integrity controls (and supply-chain hygiene) important even for “LOW” findings.
- Attacker can influence or replace the auto-loaded config file used by Checkov.
- Weak permissions or insecure artifact handling allow unauthorized modification (repo, build workspace, mounted volumes, pipeline downloads).
- Scans run with elevated privileges or in contexts with access to sensitive assets.
- Update/patch to the latest Prisma Cloud / Checkov version that includes the fix for CVE-2026-0303.
- Harden config sources:
- Ensure config files are read-only where possible.
- Validate integrity of configuration inputs (e.g., locked dependencies, checksum validation, signed artifacts).
- Tighten pipeline permissions:
- Restrict write access to configuration directories/repositories.
- Use isolated runners and limit secrets exposure during scans.
- Review exposure:
- Identify where Checkov runs and what configuration files it auto-loads.
- Check CI logs/artifacts for evidence of unexpected config changes.
- Treat as a pipeline/supply-chain risk: prioritize environments with untrusted pull requests, external contributors, or broadly writable storage.
- Add monitoring for config file tampering and unexpected changes to scanning configurations.
đź“Ž
–
Reference: Vendor Advisory