Key points
- CVE-2026-0312 affects Checkov by Prisma Cloud version 3.3.0 up to, but not including, 3.3.25.
- The flaw is rated Medium severity with a CVSS score of 6.8 for the base vector.
- No special configuration is required for the vulnerability to be present on affected systems.
Palo Alto Networks has disclosed a path traversal vulnerability in Checkov by Prisma Cloud that permits unauthenticated local users to write files to arbitrary locations. The issue, tracked as CVE-2026-0312, affects version 3.3.0 through 3.3.24 and is rated Medium severity.
What happened
The vulnerability exists in Checkov by Prisma Cloud version 3.3.0 and all subsequent minor releases up to, but not including, version 3.3.25. According to the official advisory from Palo Alto Networks PSIRT, this flaw enables an unauthenticated local user to traverse directory paths and write files to any location on the scanning filesystem. The vendor states that no special configuration is required for the system to be affected by this issue.
Palo Alto Networks has assigned a Medium severity rating to the finding, noting a Base CVSS score of 6.8. The attack vector is local, and the complexity is low, though user interaction is required. The vendor confirms it is not aware of any malicious exploitation of these issues in the wild. The flaw is categorised under CWE-22, which relates to improper limitation of a pathname to a restricted directory.
Why it matters
Security operations teams relying on Checkov for infrastructure as code scanning face a risk to the integrity of their scanning environments. Because the flaw allows arbitrary file writes, a compromised local account or a malicious script running in the same context could overwrite critical system files or plant backdoors. The absence of a required special configuration means that default deployments of Checkov 3.3 are vulnerable by design.
The Medium severity rating reflects the local nature of the attack, but the potential for integrity loss on the scanning host is significant. If an attacker can execute code locally, they can leverage this path traversal to maintain persistence or escalate privileges. The vendor advises that teams should avoid running Checkov over untrusted content until a fixed version is deployed, as this reduces the likelihood of triggering the flaw.
What happens next
- Verify the installed version of Checkov by Prisma Cloud against the vulnerable range (3.3.0 to 3.3.24).
- Restrict the execution of Checkov to trusted, authenticated environments only.
- Pass configuration explicitly via a trusted configuration file rather than allowing auto-loading from the scanned directory.
- Monitor local logs for unusual file write activities in directories associated with the scanning process.
Patch priority
Teams should prioritise remediation on systems where Checkov processes untrusted or external infrastructure code. Organisations usually begin by identifying all scanning agents and build servers running the affected version, as these hosts handle diverse inputs. Before applying any updates, ensure backups of critical configuration files are current to prevent operational disruption. Test the updated version in a isolated environment to confirm compatibility with existing pipelines. If a fix is not yet available, isolate scanning tasks from production management interfaces and limit local user access to the scanning host to reduce the attack surface.
What to do and how to stay safe: Palo Alto Networks
- Audit your inventory to locate all instances of Checkov version 3.3.0 through 3.3.24.
- Restrict access to scanning hosts so that only authorised users can execute the tool.
- Configure Checkov to use explicit, trusted configuration files instead of auto-loading settings from scanned directories.
- Monitor filesystem integrity on scanning servers for unexpected file modifications or new executables.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Checkov are affected by CVE-2026-0312?
The vulnerability affects Checkov by Prisma Cloud version 3.3.0 and all minor versions up to, but not including, 3.3.25.
Is there a patch available for this path traversal vulnerability?
No fixed version has been confirmed yet; the vendor advises avoiding untrusted content and using explicit configuration until a fix is deployed.
What is the severity rating of this vulnerability?
Palo Alto Networks has rated the severity as Medium, with a Base CVSS score of 6.8.
