CVE-2026-104994: Trivy Path Traversal Vulnerability

CVE-2026-104994 Overview

CVE-2026-104994 is a directory traversal vulnerability [CWE-24] in Aqua Security's Trivy scanner prior to version 0.71.0. The flaw resides in Terraform filesystem functions used during misconfiguration (misconf) scanning. When Trivy evaluates Terraform expressions, filesystem functions can access pathnames above the scan root through an underlying OS filesystem fallback in the mapfs package. An adversary who submits a crafted Terraform configuration, such as through a third-party pull request processed by an automated scanner, can read sensitive files on the scanning host and exfiltrate their contents through scan output.

Critical Impact
Attackers can leak sensitive host files, including secrets accessible to the Trivy scanner process, by influencing Terraform input processed during automated misconf scanning.

Affected Products

Aqua Security Trivy versions prior to 0.71.0
Trivy misconf scanning module for Terraform configurations
CI/CD pipelines that run Trivy against untrusted Terraform input (for example, third-party pull requests)

Discovery Timeline

2026-10-02 - CVE-2026-104994 published to the National Vulnerability Database
2026-10-05 - Last updated in NVD database

Technical Details for CVE-2026-104994

Vulnerability Analysis

Trivy's Terraform parser exposes HashiCorp Configuration Language (HCL) standard library functions that operate on files, including file, filebase64, and templatefile. These functions receive a filesystem abstraction (fs.FS) sourced from Trivy's internal mapfs package. The mapfs implementation supports an in-memory map of scanned files but falls back to the underlying operating system filesystem when a requested path is not present in the map. During misconf scanning, this fallback allows HCL expressions to reference arbitrary paths outside the scan root, including absolute paths and parent-directory traversals.

An attacker who controls a Terraform file processed by Trivy can embed an expression such as file("/etc/passwd") or reference secrets located outside the repository. Trivy evaluates the expression and, if the scan output surfaces attribute values, the file contents are returned to the attacker.

Root Cause

The root cause is an unsandboxed filesystem passed to Terraform function evaluation. The mapfs.FS type retained a reference to an underlying OS root, so file lookups for paths not stored in memory were resolved against the host filesystem. The patch introduces a Sandboxed() method that returns a mapfs.FS without the underlying OS fallback, and Functions() now wraps the target filesystem before handing it to HCL function implementations.

Attack Vector

Exploitation requires that Trivy perform misconf scanning against attacker-controlled Terraform content. The common scenario is a CI job that scans third-party pull requests. The attacker commits a Terraform file whose expressions reference sensitive paths; Trivy evaluates them during scanning, and the resulting values are rendered into scan output visible to the attacker through CI logs or pull request comments.

// Patch excerpt: pkg/iac/scanners/terraform/parser/functions.go
// Source: https://github.com/aquasecurity/trivy/commit/9d91b888cf63023e9c09b64259a4c1cea8dfe993
func Functions(target fs.FS, baseDir string) map[string]function.Function {
    // Use a sandboxed FS without underlyingRoot for file functions to prevent
    // path traversal above the scan root via mapfs's underlying OS fallback.
    if mfs, ok := target.(*mapfs.FS); ok {
        target = mfs.Sandboxed()
    } else {
        target = mapfs.New()
    }
    return map[string]function.Function{
        "abs":     stdlib.AbsoluteFunc,
        "abspath": funcs.AbsPathFunc,
        // ...
    }
}

// Patch excerpt: pkg/mapfs/fs.go
// Sandboxed returns a copy of the filesystem without the underlying root,
// preventing access to the local filesystem outside of the in-memory filesystem.
func (m *FS) Sandboxed() *FS {
    return &FS{root: m.root}
}

Detection Methods for CVE-2026-104994

Indicators of Compromise

Terraform files in pull requests that invoke HCL file functions such as file(), filebase64(), or templatefile() with absolute paths or .. traversal segments.
Trivy misconf scan output or CI logs containing contents of host files unrelated to the repository being scanned (for example, /etc/passwd, /proc/self/environ, SSH keys, cloud credential files).
Pull requests from untrusted contributors that modify .tf files to add expressions dereferencing filesystem paths outside the project tree.

Detection Strategies

Scan Terraform source in pull requests for HCL function calls that read filesystem paths outside the repository root before invoking Trivy.
Monitor CI job logs and scan artifacts for leaked file contents such as credential patterns, private keys, or environment variable dumps.
Audit Trivy versions in use across build infrastructure and flag any instance earlier than 0.71.0.

Monitoring Recommendations

Capture CI runner process telemetry and alert on Trivy child processes that read sensitive paths like /root, ~/.aws, or ~/.ssh during misconf scans.
Centralize Trivy scan output and apply secret-detection rules to identify exfiltrated credentials.
Review pull request automation that posts Trivy output back to the PR for signs of sensitive file disclosure.

How to Mitigate CVE-2026-104994

Immediate Actions Required

Upgrade Trivy to version 0.71.0 or later across all CI/CD runners, container images, and developer workstations.
Rotate any credentials, tokens, or keys that were readable by the Trivy process on systems that scanned untrusted Terraform input.
Restrict Trivy misconf scans of third-party pull requests to isolated runners without access to production secrets.

Patch Information

The fix is delivered in Trivy 0.71.0 via Trivy Pull Request #10664 and committed as Trivy Commit 9d91b88. The patch adds a Sandboxed() method to mapfs.FS and routes Terraform filesystem functions through the sandboxed filesystem, removing the OS fallback. Full details are in the GitHub Security Advisory GHSA-87hp-4m93-274g and the Trivy Changelog.

Workarounds

Disable Trivy misconf scanning for Terraform configurations originating from untrusted contributors until the upgrade is complete.
Run Trivy inside an ephemeral container with a minimal filesystem that contains only the scan target, eliminating sensitive files from the process view.
Drop filesystem privileges by running Trivy as an unprivileged user with no access to secrets, SSH keys, or cloud credential files on the runner.

bash

# Upgrade Trivy and verify the fixed version is installed
trivy --version
# Install the patched release (example for Linux amd64)
TRIVY_VERSION=0.71.0
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
    | sh -s -- -b /usr/local/bin v${TRIVY_VERSION}

# Run misconf scans for untrusted PRs inside an isolated container
# with no host secrets mounted
docker run --rm --read-only \
    -v "$(pwd)/pr-checkout:/scan:ro" \
    aquasec/trivy:${TRIVY_VERSION} config /scan