CVE-2026-14468 Overview
HashiCorp Terraform Enterprise contains a path traversal vulnerability [CWE-22] in its version control system (VCS) ingestion of registry modules. The ingestion process does not correctly enforce the intended boundary on packaged module content. An authenticated user can include files from outside the intended repository content within a module and then download those files. This exposes sensitive files readable by the ingestion process to unauthorized retrieval. HashiCorp assigned CVE-2026-14468 to this issue and released fixes in Terraform Enterprise v2.0.4 and v1.2.4.
Critical Impact
Authenticated users can read arbitrary files accessible to the Terraform Enterprise ingestion process, potentially exposing secrets, configuration data, and other sensitive server-side content.
Affected Products
- HashiCorp Terraform Enterprise versions prior to v2.0.4 (2.x branch)
- HashiCorp Terraform Enterprise versions prior to v1.2.4 (1.x branch)
- Self-hosted Terraform Enterprise instances performing VCS-based module ingestion
Discovery Timeline
- 2026-07-06 - CVE-2026-14468 published to NVD
- 2026-07-07 - Last updated in NVD database
Technical Details for CVE-2026-14468
Vulnerability Analysis
Terraform Enterprise ingests modules from connected VCS providers and packages the module contents for storage in its private module registry. The ingestion routine is expected to constrain packaged content to files within the module's declared repository path. This boundary check is not correctly enforced, allowing crafted module structures to reference files outside the intended repository scope. When a user later downloads the module, those out-of-bounds files are returned along with legitimate content. The classification [CWE-22] Path Traversal reflects the underlying flaw.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory during VCS module packaging. The ingestion code does not resolve and validate file paths against the intended repository root before including them in the packaged module archive. Symbolic links or relative path references within the source repository can therefore escape the module boundary and pull in files from the host filesystem or adjacent locations readable by the ingestion process.
Attack Vector
Exploitation requires an authenticated Terraform Enterprise user with permission to register or update VCS-backed modules. The attacker prepares a repository whose contents reference paths outside the module directory, connects it to Terraform Enterprise, and triggers module ingestion. Once packaging completes, the attacker downloads the resulting module artifact and extracts the sensitive files. The scope change reflected in the CVSS vector indicates that resources beyond the vulnerable component's security scope are exposed.
No verified public proof-of-concept code is available. See the HashiCorp Security Advisory for vendor-provided technical details.
Detection Methods for CVE-2026-14468
Indicators of Compromise
- Module ingestion jobs referencing repositories containing symbolic links or unusual relative path structures pointing outside the module directory.
- Downloaded module archives containing files unrelated to Terraform configuration, such as /etc/*, credential files, or Terraform Enterprise application files.
- Registry module versions published by low-privilege or newly created accounts immediately followed by module download activity.
Detection Strategies
- Audit Terraform Enterprise ingestion logs for module packaging operations that produce archives with paths resolving outside the source repository root.
- Review VCS webhook and module publish events correlated with immediate module download requests from the same principal.
- Inspect stored module artifacts for filenames or directory structures that do not match expected Terraform module layouts (*.tf, *.tfvars, README, LICENSE).
Monitoring Recommendations
- Enable verbose logging on the Terraform Enterprise ingestion service and forward logs to a centralized analytics platform for retention and query.
- Alert on repeated module publish-then-download sequences from the same user within short time windows.
- Monitor filesystem access patterns of the ingestion process for reads outside expected working directories.
How to Mitigate CVE-2026-14468
Immediate Actions Required
- Upgrade Terraform Enterprise to v2.0.4 or v1.2.4 depending on the deployed branch.
- Review authenticated user accounts with permission to publish VCS-backed modules and remove unnecessary privileges.
- Audit the private module registry for recently published modules and inspect their packaged contents for unexpected files.
Patch Information
HashiCorp fixed the vulnerability in Terraform Enterprise v2.0.4 and v1.2.4. Upgrade instructions and release notes are available in the HashiCorp Security Advisory HCSEC-2026-17.
Workarounds
- Restrict module publishing permissions to trusted users until the upgrade is applied.
- Disable or tightly scope VCS connections used for private module ingestion in multi-tenant environments.
- Rotate any secrets, tokens, or credentials that may have been readable by the Terraform Enterprise ingestion process if compromise is suspected.
# Verify the installed Terraform Enterprise version after upgrade
tfe-admin support-bundle --version
# Expected output should show v2.0.4 or v1.2.4 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
