CVE-2026-14978 Overview
CVE-2026-14978 affects HashiCorp go-slug versions 0.4.0 through 0.18.2. The library packages Terraform configuration directories into slug archives for upload to Terraform Cloud, Terraform Enterprise, and related services. A local attacker can bypass .terraformignore exclusions and cause sensitive files to be included in slug uploads. The flaw stems from improper handling of Unicode normalization during path matching [CWE-176]. Files intended to be excluded from uploads can reach remote systems when their paths use alternate Unicode representations that fail to match ignore patterns.
Critical Impact
Sensitive files excluded via .terraformignore can be inadvertently uploaded to Terraform Cloud or Enterprise, exposing secrets, credentials, or configuration data intended to remain local.
Affected Products
- HashiCorp go-slug 0.4.0 through 0.18.2
- Terraform tooling and workflows that embed the go-slug library
- IBM products bundling affected go-slug versions (see IBM advisory)
Discovery Timeline
- 2026-08-19 - CVE-2026-14978 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-14978
Vulnerability Analysis
The go-slug library builds tar archives of Terraform configuration directories and honors .terraformignore files to exclude paths from those archives. The vulnerability lies in the path-matching logic that compares file paths against ignore patterns without first normalizing Unicode representations. Attackers can craft filenames using alternative Unicode forms, such as NFD versus NFC composed characters, that appear identical visually but fail byte-level pattern matches.
When go-slug walks the directory tree, it compares each entry to the exclusion patterns. Paths using unnormalized code points slip past the matcher and are packaged into the resulting slug. The archive is then uploaded to the remote Terraform backend, exposing files the operator believed were excluded. Exploitation requires local placement of files and user interaction to trigger a Terraform upload operation.
Root Cause
The defect is an improper handling of Unicode encoding weakness [CWE-176]. The ignore-pattern matcher performs string comparison on raw byte sequences rather than on Unicode-normalized forms. Two paths that render identically in a filesystem browser can differ at the byte level, allowing one representation to match an ignore rule while the other bypasses it.
Attack Vector
A local attacker who can write files into a Terraform working directory places a payload file whose name uses a non-normalized Unicode representation of a path that should match a .terraformignore rule. When a developer or CI process runs a Terraform operation that invokes go-slug, the file is packaged and transmitted to the remote backend. The vector requires local access and user interaction to trigger the upload. Confidentiality is affected; integrity and availability are not.
No public exploit code is available. See the IBM Support Page for vendor-specific technical details.
Detection Methods for CVE-2026-14978
Indicators of Compromise
- Files present in uploaded Terraform slugs that match .terraformignore rules when viewed but use non-NFC Unicode code points in their paths.
- Unexpected secrets, credentials, or state artifacts appearing in Terraform Cloud or Enterprise workspace uploads.
- Filesystem entries whose names contain combining characters or precomposed variants of expected filenames.
Detection Strategies
- Inspect generated slug archives before upload and compare included paths against expected .terraformignore exclusions.
- Run Unicode normalization checks (NFC/NFD comparison) across Terraform working directories to identify duplicate or alternate-form filenames.
- Audit CI/CD pipelines that invoke go-slug for versions between 0.4.0 and 0.18.2.
Monitoring Recommendations
- Log all Terraform slug upload operations and record archive manifests for post-upload review.
- Alert on new files appearing in Terraform working directories whose names contain non-ASCII or combining Unicode characters.
- Track dependency versions of go-slug across build systems and flag versions in the vulnerable range.
How to Mitigate CVE-2026-14978
Immediate Actions Required
- Upgrade go-slug to a version later than 0.18.2 in all Terraform tooling and downstream products.
- Audit recent Terraform Cloud and Enterprise workspaces for files that should have been excluded from uploads.
- Rotate any secrets or credentials that may have been included in prior slug uploads.
Patch Information
HashiCorp addressed the flaw in go-slug releases after 0.18.2. IBM has published guidance for affected bundled products at the IBM Support Page. Rebuild and redeploy any application that vendors the go-slug library after upgrading.
Workarounds
- Restrict write access to Terraform working directories so only trusted users and processes can create files.
- Pre-process working directories with a Unicode normalization pass that converts all filenames to NFC before invoking Terraform.
- Review .terraformignore matches on a canonicalized copy of the directory tree prior to running upload operations.
# Normalize filenames to NFC before Terraform operations
find . -depth -exec sh -c 'for f; do
nfc=$(printf "%s" "$f" | uconv -f UTF-8 -t UTF-8 -x "::NFC;")
[ "$f" != "$nfc" ] && mv "$f" "$nfc"
done' sh {} +
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
