Known Vulnerabilities for Terraform by Hashicorp
Listed below are 5 of the newest known vulnerabilities associated with "Terraform" by "Hashicorp".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-123849 json | In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers | Not Provided | 2026-11-06 | 2026-11-07 |
| CVE-2026-123293 json | In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool... | Not Provided | 2026-11-06 | 2026-11-07 |
| CVE-2026-116683 json | CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a ... | Not Provided | 2026-10-27 | 2026-11-03 |
| CVE-2026-116676 json | Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 ... | Not Provided | 2026-10-27 | 2026-11-03 |
| CVE-2026-115414 json | OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform... | Not Provided | 2026-10-22 | 2026-10-23 |
| CVE-2026-111929 json | Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC ha... | Not Provided | 2026-10-17 | 2026-10-19 |
| CVE-2026-104994 json | Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the ... | Not Provided | 2026-10-02 | 2026-10-05 |
| CVE-2026-103929 json | mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default non-safe mode, mise loads ... | Not Provided | 2026-10-14 | 2026-10-15 |
| CVE-2026-102649 json | Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` ac... | Not Provided | 2026-10-26 | 2026-10-31 |
| CVE-2026-91892 json | Dell Terraform Provider for PowerFlex, versions prior to 1.9.0, contains a vulnerability that may permit the use of depreca... | Not Provided | 2026-11-11 | 2026-11-11 |
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Hashicorp | Terraform | 2.9.0 | |||
| Application | Hashicorp | Terraform | 2.8.0 | |||
| Application | Hashicorp | Terraform | 2.7.0 | |||
| Application | Hashicorp | Terraform | 2.6.0 | |||
| Application | Hashicorp | Terraform | 2.5.0 | |||
| Application | Hashicorp | Terraform | 2.4.0 | |||
| Application | Hashicorp | Terraform | 2.3.0 | |||
| Application | Hashicorp | Terraform | 2.2.0 | |||
| Application | Hashicorp | Terraform | 2.19.0 | |||
| Application | Hashicorp | Terraform | 2.18.0 | |||
| Application | Hashicorp | Terraform | 2.17.0 | |||
| Application | Hashicorp | Terraform | 2.16.0 | |||
| Application | Hashicorp | Terraform | 2.15.0 | |||
| Application | Hashicorp | Terraform | 2.14.0 | |||
| Application | Hashicorp | Terraform | 2.13.0 | |||
| Application | Hashicorp | Terraform | 2.12.0 | |||
| Application | Hashicorp | Terraform | 2.11.0 | |||
| Application | Hashicorp | Terraform | 2.10.0 | |||
| Application | Hashicorp | Terraform | 2.1.0 | |||
| Application | Hashicorp | Terraform | 2.0.0 |