CVE-2026-0303: RCE in Palo Alto Checkov via auto-loaded config files

CVE-2026-0303 Vulnerability Key Information Summary Vulnerability Overview Vulnerability Name: Code Execution via Auto-Loaded Configuration Files in Checkov by Prisma Cloud Vulnerability Type: Code Execution Description: Palo Alto Networks Checkov by Prisma Cloud is susceptible to a code execution vulnerability where arbitrary code can be executed when Checkov scans a directory containing attacker-controllable configuration files. Severity: LOW (CVSS 4.0 score 2.4 / CVSS 3.1 score 5.3) Urgency: MODERATE Attack Vector: LOCAL Attack Complexity: LOW Required Privileges: NONE User Interaction: PASSIVE Impact: Confidentiality LOW, Integrity HIGH, Availability HIGH Exploitation Status: Palo Alto Networks is not aware of any malicious exploitation of this vulnerability Weakness Types: CWE-829 (Inclusion of Functionality from Untrusted Control Domains), CAPEC-248 (Command Injection) Scope of Impact Configuration Required for Exposure: No special configuration is required for exploitation. CPE Applicability: is vulnerable in the range [3.2.0, 3.2.532). Remediation Recommended Solution: Upgrade Checkov by Prisma Cloud from versions 3.2.0 through 3.2.531 to version 3.2.532 or higher. Automatic Updates: The integration of Checkov with Prisma Cloud will automatically upgrade the version when a newer one is available. Workarounds Prior to deploying the fixed version, avoid running Checkov against untrusted content; explicitly pass configuration through trusted configuration files rather than allowing configuration files to be auto-loaded from the scanned directory. Timeline 2026-09-10: Initial Publication POC / Exploit Code The page does not include POC code or exploit code blocks.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-0303: RCE in Palo Alto Checkov via auto-loaded config files

More from this source