CVE-2026-0302 PUBLISHED

Checkov by Prisma Cloud: OS Command Injection Vulnerability

Assigner: palo_alto
Reserved: 03.11.2025 Published: 10.09.2026 Updated: 10.09.2026

An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local user to execute arbitrary commands in the processes running Checkov.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:U/AU:N/R:U/V:D/RE:M/U:Amber
CVSS Score: 1.1

If the user is able to influence input consumed by a Checkov scan.

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	None	Confidentiality	High
Attack Complexity	Low	Integrity	Low	Integrity	High
Attack Requirements	None	Availability	None	Availability	High
Privileges Required	Low
User Interaction	Passive

If the user is able to influence input consumed by a Checkov scan.

CVSS 4.0

Product Status

Vendor	Palo Alto Networks
Product	Checkov by Prisma Cloud
Versions	Default: unaffected affected from 3.2.0 to 3.2.502 (excl.)

Exploits

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Credits

George Gherasim finder

References

https://security.paloaltonetworks.com/CVE-2026-0302

Problem Types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE

Impacts

CAPEC-88 OS Command Injection