Terrascan server mode exposes a SSRF vulnerability that allows an unauthenticated remote attacker to supply an arbitrary webhook_url via a multipart form POST to the file scan endpoint. After a scan, the server unconditionally posts the entire scan result JSON to that URL, forwarding an attacker‑supplied token as a Bearer header. This data leak makes confidential infrastructure-as-code findings available to an attacker and gives them the ability to target internal hosts or perform blind network probing.

The affected product is Tenable’s Terrascan, versions 1.18.3 and earlier running in server mode (terrascan server). The server binds to 0.0.0.0 with no authentication and has not been updated since the project was archived in August 2023, so the vulnerability remains present in any existing deployment of these versions.

The CVSS score is 8.7, indicating high severity. Although the EPSS score is unavailable, the lack of authentication on a service reachable over the network gives attackers a straightforward SSRF vector. The vulnerability is not listed in KEV, but the persistence of the vulnerability and the retry logic (up to 10 attempts) increase the likelihood of successful exploitation, especially against poorly segmented or inadequately protected environments.