778 matches found
CVE-2026-71494
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remotevariablesloader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination...
CVE-2026-71494 Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remotevariablesloader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination...
CVE-2026-71494 Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remotevariablesloader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination...
EUVD-2026-64019
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remotevariablesloader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination...
CVE-2026-71494
Infracost prior to 0.10.45 contains a token disclosure vulnerability in internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths. The root cause is that a configured Terraform Cloud or registry token can be attached to a destination h...
PT-2026-79415
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote variables loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destinati...
CVE-2026-14978
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...
EUVD-2026-63099
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...
CVE-2026-14978
go-slug v0.4.0-v0.18.2 mishandles Unicode normalization during .terraformignore matching (CWE-176), allowing files differing only by normalization form to bypass exclusions and be uploaded to Terraform Cloud/Enterprise, exposing sensitive local files. Fixed in v0.18.3; no workaround provided. Exp...
CVE-2026-14978 Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...
Security Bulletin: Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions
Summary The github.com/hashicorp/go-slug library before v0.18.3 is vulnerable to an exclusion bypass in .terraformignore handling that may allow files intended to be excluded from Terraform Cloud or Terraform Enterprise working directory uploads to be included instead on affected macOS filesystem...
BIT-CONSUL-2026-16496 terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user
The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability,...
GO-2026-6180 vulnerabilities
Vulnerabilities for packages: aactl, langfuse, prometheus-mongodb-exporter, k3d, reports-server, snyk-cli, commercial-grafana, k3s, nerdctl, langfuse-fips, zot, spire-server, kyverno, terraform, k8s-device-plugin, kots, containerd...
GO-2026-6179 vulnerabilities
Vulnerabilities for packages: aactl, langfuse, prometheus-mongodb-exporter, k3d, reports-server, snyk-cli, commercial-grafana, k3s, nerdctl, langfuse-fips, zot, spire-server, kyverno, terraform, k8s-device-plugin, kots, containerd...
CVE-2026-56865 vulnerabilities
Vulnerabilities for packages: aactl, langfuse, prometheus-mongodb-exporter, k3d, reports-server, snyk-cli, commercial-grafana, k3s, nerdctl, langfuse-fips, zot, spire-server, kyverno, terraform, k8s-device-plugin, kots, containerd...
CVE-2026-56864 vulnerabilities
Vulnerabilities for packages: aactl, langfuse, prometheus-mongodb-exporter, k3d, reports-server, snyk-cli, commercial-grafana, k3s, nerdctl, langfuse-fips, zot, spire-server, kyverno, terraform, k8s-device-plugin, kots, containerd...
CVE-2026-56858 vulnerabilities
Vulnerabilities for packages: kubescape-server-fips, terraform-provider-acme-fips, docker-compose-fips, buildkite-agent, crossplane-provider-aws-s3, k8s-image-swapper, chainloop-control-plane, k8sgpt, rabbitmq-cluster-operator-fips, crossplane-provider-aws-appstream, kube-fluentd-operator,...
GO-2025-3847 vulnerabilities
Vulnerabilities for packages: terraform-provider-acme-fips, terraform-provider-acme, sftpgo, traefik, traefik-fips...