Vulnerabilidades do HashiCorp Terraform Enterprise
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam HashiCorp Terraform Enterprise: 2 registro(s), com versões afetadas e correções.
CVE-2026-14468
Alta · 7.7
CWE-22 06/07/2026
Path traversal allows arbitrary file read in Terraform Enterprise container
HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion of registry modules that did not correctly enforce the intended boundary on packaged module content. This may allow an authenticated user to include files from outside the intended repository content in a module and then download them, potentially exposing sensitive files readable by the ingestion process. This vulnerability, CVE-2026-14468, is fixed in Terraform Enterprise v2.0.4 and v1.2.4.
CVE-2025-13432
Média · 4.3
CWE-863 21/11/2025
Terraform Enterprise state versions can be created by users with specific permissions without sufficient write access
Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied. This vulnerability, CVE-2025-13432, is fixed in Terraform Enterprise version 1.1.1 and 1.0.3.