What is the CVSS score of CVE-2026-14468?

CVE-2026-14468 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Terraform Enterprise are affected by CVE-2026-14468?

CVE-2026-14468 in Terraform Enterprise enables arbitrary file read access during VCS-based registry module ingestion, creating a direct exfiltration vector for credentials, API tokens, and…. A patch is available.

How to fix or mitigate CVE-2026-14468?

Within 24 hours: Inventory all Terraform Enterprise instances with VCS-integrated registry module ingestion enabled; identify service account credentials with filesystem access; review recent module ingestion logs for suspicious activity. Within 7 days: Disable VCS-based registry module ingestion as temporary mitigation; restrict service account filesystem permissions to minimal required access; implement forensic logging on module ingestion operations. Within 30 days: Apply vendor patch when released (monitor HashiCorp advisories for CVE-2026-14468 fix version); restore VCS registry functionality post-patch under updated privilege enforcement.

Terraform Enterprise CVE-2026-14468

EUVD-2026-41946 HIGH

Path Traversal (CWE-22)

2026-07-06 HashiCorp

GHSA-29x3-448h-cjxw

Path Traversal Hashicorp Terraform Enterprise

7.7

CVSS 3.1 · Vendor: HashiCorp

Severity by source

Vendor (HashiCorp) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network-reachable with low complexity but needs an authenticated module-publisher (PR:L); scope change reflects reading files outside the module boundary; confidentiality-only impact so I/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (HashiCorp).

CVSS VectorVendor: HashiCorp

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 06, 2026 - 22:02 EUVD

Analysis Generated

Jul 06, 2026 - 21:55 vuln.today

DescriptionCVE.org

HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion of registry modules that did not correctly enforce the intended boundary on packaged module content. This may allow an authenticated user to include files from outside the intended repository content in a module and then download them, potentially exposing sensitive files readable by the ingestion process. This vulnerability, CVE-2026-14468, is fixed in Terraform Enterprise v2.0.4 and v1.2.4.

Articles & Coverage 2

News 3 New HashiCorp Vulnerabilities - 1 Critical, 2 High Severity Jul 07, 2026 News 3 New HashiCorp Vulnerabilities - 1 Critical, 2 High Severity Jul 06, 2026

AnalysisAI

Arbitrary file read in HashiCorp Terraform Enterprise allows an authenticated user to escape the intended repository boundary during VCS-based registry module ingestion, pulling files from outside the source repository into a packaged module and downloading them. Because the ingestion process runs with its own filesystem privileges, an attacker can exfiltrate sensitive files (secrets, configuration, tokens) readable by that process. Reported by HashiCorp with no public exploit identified at time of analysis; the CVSS 7.7 (scope-changed) score reflects high confidentiality impact against a self-hosted enterprise platform.

Technical ContextAI

Terraform Enterprise is HashiCorp's self-hosted commercial platform for running Terraform Infrastructure-as-Code, including a private module registry that ingests modules directly from connected version control systems (GitHub, GitLab, Bitbucket, etc.). When a module is published, the platform clones and packages the referenced repository content. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): the packaging logic did not correctly enforce the boundary on what constitutes 'module content,' so path references (e.g. symlinks or relative traversal sequences) could reach files outside the intended repository tree. The exposed data is whatever the ingestion process account can read on the host, which typically extends well beyond the checked-out repository. The single affected CPE is cpe:2.3:a:hashicorp:terraform_enterprise:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: upgrade Terraform Enterprise to v2.0.4 (v2.x line) or v1.2.4 (v1.2.x line), per HashiCorp advisory HCSEC-2026-17 (https://discuss.hashicorp.com/t/hcsec-2026-17-terraform-enterprise-vulnerable-to-arbitrary-file-read/77549). Until patching is possible, reduce exposure by restricting which users hold module-publishing/VCS-ingestion permissions and by auditing membership of teams with registry write access, since exploitation requires an authenticated account - the trade-off is reduced self-service module publishing for teams. Where feasible, run the ingestion process under a least-privilege account and isolate its filesystem so that sensitive host secrets and credentials are not readable by it, limiting what a successful traversal can expose; this may require reworking how the platform sources credentials. Review ingestion/module-publish logs for anomalous downloads or modules containing unexpected file paths or symlinks.