CVE-2026-14468

Received Received - Intake

Terraform Enterprise VCS Module Path Traversal

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: HashiCorp Inc.

Description

HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion of registry modules that did not correctly enforce the intended boundary on packaged module content. This may allow an authenticated user to include files from outside the intended repository content in a module and then download them, potentially exposing sensitive files readable by the ingestion process. This vulnerability, CVE-2026-14468, is fixed in Terraform Enterprise v2.0.4 and v1.2.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-06

Last Modified

2026-07-06

Generated

2026-07-07

AI Q&A

2026-07-07

EPSS Evaluated

N/A

NVD

CVE-2026-14468

Affected Vendors & Products

Vendor	Product	Version / Range
hashicorp	terraform_enterprise	to 2.0.4 (inc)
hashicorp	terraform_enterprise	to 1.2.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Impact Analysis

The vulnerability can lead to unauthorized exposure of sensitive files. An authenticated user could exploit this issue to access files outside the intended module repository, which might contain confidential or sensitive information.

This exposure could compromise the confidentiality of data within your Terraform Enterprise environment.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade HashiCorp Terraform Enterprise to version 2.0.4 or 1.2.4, where the issue has been fixed.

Executive Summary

This vulnerability exists in HashiCorp Terraform Enterprise's version control system ingestion of registry modules. It occurs because the system does not properly enforce boundaries on the packaged module content. As a result, an authenticated user can include files from outside the intended repository content within a module.

This flaw allows the user to download files that should not be accessible, potentially exposing sensitive files that are readable by the ingestion process.

Hi! I’m here to help you understand CVE-2026-14468. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70