108 matches found
CLEANSTART-2026-KS29431 Security fix for CVE-2026-32285 applied in: gitlab-runner 18.11.1-r0, grafana-alloy 1.13.1-r1, kubevela 1.10.8-r0, prometheus 3.11.0-r0, tempo 2.10.3-r0, tempo 2.9.1-r1, tempo-fips 2.10.3-r0, tempo-fips 2.9.1-r1, terragrunt-fips 0.94.0-r3, terragrunt-fips 0.95.1-r3, terragrunt-fips 0.96.1-r3, terragrunt-fips 0.98.0-r4
CVE-2026-32285 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
SUSE CVE-2026-45099
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...
CVE-2026-45099
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...
EUVD-2026-64128
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...
CVE-2026-45099 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...
CVE-2026-45099 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...
CVE-2026-45099
Terragrunt (an orchestration tool for OpenTofu/Terraform) prior to v1.0.4 is vulnerable to arbitrary file deletion via a maliciously crafted .terragrunt-module-manifest file in a downloaded external module. The root cause is that fileManifest.Clean() in internal/util/file.go trusted decoded paths...
CVE-2026-45099 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...
CVE-2026-71494: Insufficiently Protected Credentials
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remotevariablesloader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination...
CVE-2026-45099: Improper Limitation of a Pathname to a Restricted Directory
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...
GO-2026-6241 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest in github.com/gruntwork-io/terragrunt
Terragrunt: Arbitrary File Deletion via Malicious Module Manifest in github.com/gruntwork-io/terragrunt...
GHSA-8394-6F8R-WHXG Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...
Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...
PT-2026-76888
Name of the Vulnerable Software and Affected Versions Terragrunt versions prior to 1.0.4 Description Terragrunt contains a flaw that allows arbitrary file deletion when downloading external modules. The issue occurs during the directory cleanup process within the fileManifest.Clean function locat...
GO-2024-2948 vulnerabilities
Vulnerabilities for packages: snyk-cli, zarf, kubescape, k9s, grype, terragrunt, trivy, trivy-fips, tflint, conftest-fips, terraform, wolfictl, kots, conftest, zot, tfsec...
GO-2024-2698 vulnerabilities
Vulnerabilities for packages: nuclei, kubescape, k9s, terragrunt, chainctl, vault, wolfictl, kots, zarf, filebrowser, gotenberg...
GO-2026-4600 vulnerabilities
Vulnerabilities for packages: amazon-k8s-cni-fips, polaris, flux-operator, pgwatch, victoriametrics-cluster, metacontroller, grafana-operator-fips, aws-ebs-csi-driver-fips, go, victorialogs, pluto, victoriametrics-fips, victoriametrics-cluster-fips, nova, victoriametrics, flux-fips,...
GO-2026-5490 vulnerabilities
Vulnerabilities for packages: kyverno, rancher-fleet-fips, syft, cerbos-fips, seaweedfs-rocksdb, grafana, kyverno-fips, nemo, rclone, rclone-fips, telegraf, cerbos, skaffold-fips, flux-fips, chainloop-cli, terragrunt, scorecard, chainloop-cli-fips, syft-fips, upwind-agent, gitlab-rails-ce,...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: trufflehog, tflint, grafana-alloy, steampipe, envoy-gateway, trivy-operator, opentofu, nuclei, terragrunt, rancher-fleet, filebrowser, k9s, gitleaks, podman, guac, xeol, zarf, vcluster, nsc, zot, trivy, kubescape-operator, undock, terraform, gitness, gptscript...