CVE-2026-14468highCWE-22

CVE-2026-14468: falha de alta gravidade em HashiCorp Terraform Enterprise

Path traversal allows arbitrary file read in Terraform Enterprise container

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Terraform Enterprise

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.7epss 0.4%
HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion of registry modules that did not correctly enforce the intended boundary on packaged module content. This may allow an authenticated user to include files from outside the intended repository content in a module and then download them, potentially exposing sensitive files readable by the ingestion process. This vulnerability, CVE-2026-14468, is fixed in Terraform Enterprise v2.0.4 and v1.2.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
HashiCorp · Terraform Enterprise
CVEs relacionadas — HashiCorp Terraform Enterprise

No mesmo produto, das mais perigosas para as menos.

CVE-2023-3114MEDIUMTerraform Enterprise Agent Pool Controls Allowed Unauthorized Workspaces To Target an Agent PoolEPSS 0.4%CVE-2025-13432MEDIUMTerraform Enterprise state versions can be created by users with specific permissions without sufficient write accessEPSS 0.2%