Local File Handling Vulnerability in HashiCorp go-slug
CVE-2026-14978

5.5MEDIUM

Key Information:

Vendor

Hashicorp
Status
Go-slug
Vendor
CVE Published:
19 August 2026

What is CVE-2026-14978?

A vulnerability in HashiCorp's go-slug affects versions 0.4.0 to 0.18.2, allowing local attackers to bypass exclusions specified in .terraformignore. This flaw arises from improper handling of Unicode normalization during path matching, which could lead to the unintended inclusion of sensitive files in Terraform slug uploads. As a result, sensitive information, which should have been excluded, may be inadvertently exposed, posing a risk to data integrity and confidentiality in Terraform deployments.

Affected Version(s)

go-slug 0.4.0 <= 0.18.2

References

https://www.ibm.com/support/pages/node/7284170
vendor-advisorypatch

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tomas Illuminati (https://github.com/tomasilluminati)
.