Description
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HashiCorp | go-slug | 0.4.0 – ≤ 0.18.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | opentofu-1.11 | 1.11.14-r5 | — |
| Wolfi rolling | opentofu-1.12 | 1.12.6-r5 | — |
| Wolfi rolling | opentofu-1.12-compat | 1.12.6-r6 | — |
| Wolfi rolling | opentofu-1.9 | 1.9.4-r30 | — |
| Wolfi rolling | terraform | 1.5.7-r61 | — |
| Wolfi rolling | terraform-mcp-server | 1.3.0-r3 | — |
Advisories 1
- WID-SEC-2026-2978 Hashicorp Terraform: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen und Offenlegung von Informationen BSI CERT-Bund (WID) · Aug 23, 2026
References
- https://www.ibm.com/support/pages/node/7284170 vendor-advisory patch