CVE-2026-14468: Terraform Enterprise Path Traversal Allows Authenticated File Disclosure

Technical summary

CVE-2026-14468 is a path traversal flaw (CWE-22) in Terraform Enterprise's VCS ingestion layer for registry modules. The system fails to properly validate and enforce content boundaries when processing packaged modules from version control systems. An authenticated attacker can manipulate module content to reference files outside the intended repository scope, then retrieve those files through the module download mechanism. This exposes any sensitive data readable by the Terraform Enterprise ingestion process, including potential secrets, keys, and configuration data. The vulnerability requires authentication and network access but has no prerequisites for exploitation beyond valid user credentials.

Business impact

This vulnerability creates a data exfiltration risk for organizations using Terraform Enterprise as a module registry. Authenticated users—whether internal developers or compromised accounts—can access sensitive files on the Terraform Enterprise host, including infrastructure-as-code artifacts, API credentials, database connection strings, and other operational secrets. The scope impact (CVSS:S:C) indicates unauthorized information disclosure may extend beyond the affected component. For enterprises managing multi-tenant infrastructure or sensitive cloud deployments via Terraform, this could lead to lateral movement, credential theft, or exposure of environment-specific configurations.

Affected systems

Terraform Enterprise versions prior to v2.0.4 and v1.2.4 are affected. Organizations running older patch levels in either the 2.0.x or 1.2.x release streams should prioritize verification of their current version. Users on 2.0.4 or later, or 1.2.4 or later, are not vulnerable.

Exploitability

Exploitation requires valid Terraform Enterprise authentication; unauthenticated attackers cannot trigger the vulnerability. However, the attack has low complexity and can be executed over the network without user interaction. Given that Terraform Enterprise is commonly accessed by development teams, the attack surface is meaningful in organizations with developer access to the registry. The vulnerability does not require special privileges beyond standard module management capabilities.

Remediation

Upgrade Terraform Enterprise to v2.0.4 or later if running the 2.0.x branch, or to v1.2.4 or later if running the 1.2.x branch. Verify the installed version via the admin console or CLI before attempting upgrades. Organizations should test upgrades in a non-production environment first, as Terraform Enterprise upgrades can impact running operations. Review access logs post-upgrade to identify any suspicious module ingestion activity during the exposure window.

Patch guidance

HashiCorp has released fixes in Terraform Enterprise v2.0.4 and v1.2.4. Obtain the latest patches from the official HashiCorp releases page and follow their documented upgrade procedure for your deployment method (virtual machine, containerized, or SaaS). Verify patch installation by confirming the version string in the admin UI or via the version API endpoint. Schedule upgrades during a maintenance window to avoid disrupting active Terraform runs.

Detection guidance

Monitor Terraform Enterprise audit logs for module ingestion events that reference unusual file paths or traversal patterns (e.g., '../' sequences in module content). Check for downloads of modules containing suspicious file references. Review VCS webhook logs to identify modules pushed with atypical payloads. If running in a containerized or VM environment, monitor filesystem access from the Terraform Enterprise ingestion process for attempts to read files outside the expected module directory. Organizations should enable and review audit logging around module registry operations.

Why prioritize this

This vulnerability merits rapid remediation due to its HIGH CVSS score (7.7), confirmed data exfiltration capability, and the sensitivity of secrets typically stored within Terraform Enterprise environments. While authentication is required, the barrier to exploitation is low for insiders or compromised developers. The scope-change impact elevates risk in multi-tenant or shared registry scenarios. Prioritize patching in production environments managing critical infrastructure.

Risk score, explained

The CVSS 3.1 score of 7.7 reflects high confidentiality impact (C:H) with no integrity or availability impact. The network-accessible vector (AV:N) and low attack complexity (AC:L) increase exploitability. Authentication requirement (PR:L) provides some control, preventing fully unauthenticated attacks. Scope change (S:C) indicates the vulnerability may affect security boundaries beyond Terraform Enterprise itself, such as the broader infrastructure described in Terraform configurations.

Frequently asked questions