A server‑side request forgery flaw allows a local unauthenticated user to cause Checkov by Prisma Cloud to send HTTPS requests from the host to internal networks, potentially accessing or modifying sensitive resources that the host is authorized to reach. The vulnerability could enable attackers to enumerate internal services, bypass network segmentation, or root out privileged data. The weakness is codified as CWE‑918, highlighting mishandled input that leads to outbound traffic control by an attacker.

The affected product is Palo Alto Networks Checkov by Prisma Cloud. Vulnerable versions span from 3.2.0 through 3.2.532. The fix became available in version 3.2.533, which can be applied directly or via automatic integration updates within Prisma Cloud.

The CVSS score of 1.1 indicates a low baseline impact, and the EPSS score is not provided. The vulnerability is not listed in the CISA KEV catalog, implying limited evidence of widespread exploitation. Nevertheless, the local‑user attack vector means that anyone with physical or terminal access to a host running Checkov can exploit the flaw to perform internal reconnaissance or to target services that the host can reach. The required conditions are minimal: the user must run a vulnerable Checkov instance on the host; no remote network access is needed for exploitation.