Local File Manipulation in Terragrunt by Gruntwork

CVE-2026-64672

What is CVE-2026-64672?

Terragrunt, an orchestration tool that supports Infrastructure as Code in OpenTofu or Terraform, exhibits a vulnerability where the catalog command could allow a local attacker to manipulate files in a shared system temporary directory. Specifically, versions prior to 1.1.1 allow an attacker to predict and redirect the cleanup and cloning process to delete and replace directories within the victim's environment. This occurs if the victim runs the terragrunt catalog command on a shared host while a symbolic link is present, posing a significant risk to data integrity. Users are strongly advised to upgrade to version 1.1.1 to mitigate this risk.

References