CVE-2026-0303: Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File (Severity: LOW)
A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.2.532 - Upgrade
Upgrade
Checkov by Prisma Cloudto a version that resolves this vulnerability.Fixed in 3.2.532 - Compensating control
Until a fixed version is deployed, avoid running Checkov over untrusted content, and pass configuration explicitly via a trusted configuration file rather than allowing configuration to be auto-loaded from the scanned directory.
Event History
Frequently Asked Questions
Which environments are most exposed to this issue?
Environments where Checkov scans directories containing attacker-controlled files are exposed. This can include scanning untrusted source trees or other directories whose contents an attacker can influence.
What does an attacker need to do to trigger the issue?
The attacker needs to place or control a configuration file in a directory that Checkov will scan. The vulnerability is rated with a local attack vector and requires a user interaction according to the supplied CVSS data.