CVE-2026-64672

Received Received - Intake

Terragrunt catalog symlink path traversal vulnerability

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: GitHub, Inc.

Description

Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink already placed at that path. A local attacker who can write to the temporary directory and predict the cataloged repository can redirect cleanup and cloning outside the intended root, causing an existing repository-named directory to be deleted and replaced in the victim's security context. The attack requires the victim to run terragrunt catalog on a shared host while the symlink is present, and it is not remotely exploitable. This issue is fixed in version 1.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-03

Last Modified

2026-11-03

Generated

2026-11-04

AI Q&A

2026-11-04

EPSS Evaluated

N/A

NVD

CVE-2026-64672

Affected Vendors & Products

Vendor	Product	Version / Range
gruntwork-io	terragrunt	< 1.1.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-377	Creating and using insecure temporary files can leave application and system data vulnerable to attack.

Attack-Flow Graph

Executive Summary

This vulnerability in Terragrunt before version 1.1.1 allows a local attacker to manipulate the catalog command by placing a symlink in the system temporary directory. When a victim runs the command, it follows the symlink and redirects cleanup or cloning outside the intended directory, potentially deleting or replacing existing directories in the victim's context.

Detection Guidance

Check if your Terragrunt version is below 1.1.1 by running terragrunt --version. If it is, the system is vulnerable. Also verify if any users run terragrunt catalog on shared hosts where symlinks could be manipulated.

Impact Analysis

If you use Terragrunt on a shared host, an attacker with local access could delete important files or replace directories in your environment. This requires the attacker to predict the cataloged repository path and place a symlink beforehand, but it can lead to data loss or system compromise in your security context.

Mitigation Strategies

Upgrade Terragrunt to version 1.1.1 or later immediately. Avoid running terragrunt catalog on shared hosts with untrusted users. Ensure no symlinks exist in the temporary directory where Terragrunt operates.

Hi! I’m here to help you understand CVE-2026-64672. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...