CVE-2026-45099
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean() in internal/util/file.go. A malicious or compromised external module can place absolute or traversal paths in the manifest, causing cleanup to delete files outside the module cache that are accessible to the Terragrunt process before OpenTofu or Terraform executes.
Risk Assessment
The risk includes the possibility of deleting local source code or configuration via a malicious module, which can disrupt CI/CD pipelines. The attack requires supplying a malicious module but does not require authentication.
Recommendation
It is recommended to immediately update Terragrunt to version 1.0.4 or later. Also, exercise caution when using modules from unverified sources.
Other vulnerabilities in Terragrunt
Original NVD description (English source)
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean() in internal/util/file.go. A malicious or compromised external module can place absolute or traversal paths in the manifest, causing cleanup to delete files outside the module cache that are accessible to the Terragrunt process before OpenTofu or Terraform executes. This deletion-only primitive can remove local source code or configuration and disrupt CI/CD pipelines. This issue is fixed in version 1.0.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS