CVE-2026-14978

go-slug v0.4.0-v0.18.2 mishandles Unicode normalization during .terraformignore matching (CWE-176), allowing files differing only by normalization form to bypass exclusions and be uploaded to Terraform Cloud/Enterprise, exposing sensitive local files. Fixed in v0.18.3; no workaround provided. Exp...

CVE-2026-14978 Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

Security Bulletin: Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions

Summary The github.com/hashicorp/go-slug library before v0.18.3 is vulnerable to an exclusion bypass in .terraformignore handling that may allow files intended to be excluded from Terraform Cloud or Terraform Enterprise working directory uploads to be included instead on affected macOS filesystem...

BIT-CONSUL-2026-16496 terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user

The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability,...

GO-2026-6179 vulnerabilities

Vulnerabilities for packages: aactl, nemo, terraform, k8s-device-plugin, snyk-cli, k3s, falco-no-driver, containerd, k3d, kyverno, zot, langfuse-fips, langfuse, kots, reports-server, spire-server, nerdctl, commercial-grafana, kube-conformance, prometheus-mongodb-exporter, upwind-agent...

GO-2026-6180 vulnerabilities

Vulnerabilities for packages: aactl, nemo, terraform, k8s-device-plugin, snyk-cli, k3s, falco-no-driver, containerd, k3d, kyverno, zot, langfuse-fips, langfuse, kots, reports-server, spire-server, nerdctl, commercial-grafana, kube-conformance, prometheus-mongodb-exporter, upwind-agent...

CVE-2026-56864 vulnerabilities

Vulnerabilities for packages: aactl, nemo, terraform, k8s-device-plugin, snyk-cli, k3s, falco-no-driver, containerd, k3d, kyverno, zot, langfuse-fips, langfuse, kots, reports-server, spire-server, nerdctl, commercial-grafana, kube-conformance, prometheus-mongodb-exporter, upwind-agent...

CVE-2026-56865 vulnerabilities

Vulnerabilities for packages: aactl, nemo, terraform, k8s-device-plugin, snyk-cli, k3s, falco-no-driver, containerd, k3d, kyverno, zot, langfuse-fips, langfuse, kots, reports-server, spire-server, nerdctl, commercial-grafana, kube-conformance, prometheus-mongodb-exporter, upwind-agent...

CVE-2026-56858 vulnerabilities

Vulnerabilities for packages: atlantis-fips, helm-mapkubeapis, smarter-device-manager, cilium-cli, conftest-fips, policy-bot-fips, crossplane-provider-aws-connect-fips, coder-fips, crossplane-provider-aws-codeartifact-fips, dataplaneapi-fips, temporal-server, crossplane-provider-aws-fis,...

GO-2025-3847 vulnerabilities

Vulnerabilities for packages: terraform-provider-acme, traefik-fips, traefik, terraform-provider-acme-fips, sftpgo...

GO-2025-3413 vulnerabilities

Vulnerabilities for packages: opentofu, terraform, opentofu-fips, vault...

GO-2026-4352 vulnerabilities

Vulnerabilities for packages: opentofu...

GO-2022-1144 vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid-fips, kubeflow, terraform-provider-sendgrid, kubeflow-fips, kubeflow-katib...

GO-2022-0236 vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid-fips, grpcurl, k3d, terraform-provider-sendgrid, hey...

GO-2021-0238 vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid-fips, grpcurl, k3d, terraform-provider-sendgrid, hey...

GO-2022-0969 vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid-fips, grpcurl, dynamic-localpv-provisioner-fips, kube-state-metrics, k3d, dynamic-localpv-provisioner, kubeflow, wireguard-go, terraform-provider-sendgrid, hey, kubeflow-fips, kubeflow-katib...

GO-2023-1571 vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid-fips, grpcurl, dynamic-localpv-provisioner-fips, kube-state-metrics, restic, k3d, dynamic-localpv-provisioner, kubeflow, wireguard-go, terraform-provider-sendgrid, gke-gcloud-auth-plugin, hey, go, kubeflow-fips, kubeflow-katib...

GO-2021-0113 vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid-fips, dynamic-localpv-provisioner-fips, k3d, dynamic-localpv-provisioner, vt-cli, gitleaks, terraform-provider-sendgrid, hey...

GO-2021-0356 vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid-fips, dynamic-localpv-provisioner-fips, k3d, dynamic-localpv-provisioner, kubeflow, terraform-provider-sendgrid, kubeflow-fips...

GO-2022-1059 vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid-fips, grpcurl, dynamic-localpv-provisioner-fips, kube-state-metrics, k3d, dynamic-localpv-provisioner, vt-cli, kubeflow, gitleaks, terraform-provider-sendgrid, hey, kubeflow-fips, php-fpmexporter...