CVE-2026-45099

Received Received - Intake

Path Traversal in Terragrunt Prior to 1.0.4

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean() in internal/util/file.go. A malicious or compromised external module can place absolute or traversal paths in the manifest, causing cleanup to delete files outside the module cache that are accessible to the Terragrunt process before OpenTofu or Terraform executes. This deletion-only primitive can remove local source code or configuration and disrupt CI/CD pipelines. This issue is fixed in version 1.0.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-45099

Affected Vendors & Products

Vendor	Product	Version / Range
gruntwork	terragrunt	to 1.0.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Terragrunt before version 1.0.4 has a vulnerability where it trusts paths from a downloaded module's manifest file. A malicious module can include absolute or traversal paths in this manifest, causing Terragrunt to delete files outside the module cache during cleanup. This can disrupt CI/CD pipelines by removing local source code or configuration before OpenTofu or Terraform runs.

Detection Guidance

Detecting this vulnerability requires checking the installed version of Terragrunt. Run 'terragrunt --version' to verify if the version is below 1.0.4. If it is, the system is vulnerable.

Impact Analysis

This vulnerability can lead to loss of local source code or configuration files, disruption of CI/CD pipelines, and potential downtime if critical files are deleted. Attackers could exploit it to cause damage by removing necessary files before infrastructure deployment.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized file deletion. If Terragrunt deletes critical files like configuration or source code, it may disrupt data processing activities or compromise data integrity, which are key requirements under these regulations.

Mitigation Strategies

Upgrade Terragrunt to version 1.0.4 or later immediately. Remove any untrusted modules and audit module manifests for suspicious paths. Restrict write permissions to critical directories.

Hi! I’m here to help you understand CVE-2026-45099. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70