CVE-2026-64672

MediumCVSS 4.4

Published: 03/11/2026(UTC)Updated: 07/11/2026(UTC)Translated: 03/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

In Terragrunt prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink already placed at that path. A local attacker who can write to the temporary directory and predict the cataloged repository can redirect cleanup and cloning outside the intended root, causing an existing repository-named directory to be deleted and replaced in the victim's security context. The issue is fixed in version 1.1.1.

Risk Assessment

A local attacker on a shared host could cause directories to be deleted or overwritten in the victim's context, potentially leading to data loss or unauthorized operations. The vulnerability is not remotely exploitable.

Recommendation

Update Terragrunt to version 1.1.1 or later. Avoid running terragrunt catalog on shared hosts with untrusted users.

Other vulnerabilities in Terragrunt

CVE-2026-45099Medium
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean() in internal/util/file.go. A malicious or compromised external module can place absolute or traversal paths in the manifest, causing cleanup to delete files outside the module cache that are accessible to the Terragrunt process before OpenTofu or Terraform executes.

Original NVD description (English source)

Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink already placed at that path. A local attacker who can write to the temporary directory and predict the cataloged repository can redirect cleanup and cloning outside the intended root, causing an existing repository-named directory to be deleted and replaced in the victim's security context. The attack requires the victim to run terragrunt catalog on a shared host while the symlink is present, and it is not remotely exploitable. This issue is fixed in version 1.1.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS