Terrascan versions 1.18.3 and earlier allow an unauthenticated attacker to perform Server‑Side Request Forgery (SSRF) by uploading Infrastructure‑as‑Code templates that reference external URLs. When the server parses ARM or CloudFormation templates, it automatically resolves any templateLink.uri, parametersLink.uri, or TemplateURL fields using the hashicorp/go‑getter library. This resolution fetches the attacker‑controlled URL server‑side, enabling access to public services, internal resources, or local files via file:// schemes. The vulnerability can result in arbitrary data exfiltration or local file read and has a CVSS score of 9.3.

The affected product is Tenable’s Terrascan, specifically all releases v1.18.3 and prior running in server mode. Server mode binds to 0.0.0.0 with no authentication, allowing anyone who can reach the machine to upload templates and trigger the SSRF. No newer version exists and the project was archived in August 2023, so no patch will be released.

Based on the description, the vulnerability allows an unauthenticated attacker to upload an Infrastructure‑as‑Code template containing external URL references. The likely attack vector is via direct upload of a malicious template to any endpoint that accepts IaC files; this can be performed by anyone who can reach the server, because Terrascan server mode binds to 0.0.0.0 and has no authentication. The server will resolve these URLs server‑side, leading to a Server‑Side Request Forgery that can reach internal services or local files if file:// is used. The high CVSS score of 9.3 indicates a high severity. Because the EPSS score is not available and the vulnerability is not listed in CISA KEV, the likelihood of exploitation cannot be precisely quantified, but the absence of authentication and the nature of SSRF suggest it could be actively exploited by attackers.