CVE-2026-104994
Description
A flaw was found in Trivy. This vulnerability allows information disclosure when scanning untrusted Terraform configuration files for misconfigurations. An attacker can craft a configuration that uses filesystem functions to reference pathnames outside the designated scan root directory. This directory traversal enables Trivy to read unauthorized files on the host system and potentially expose sensitive data within the scan output.
Statement
This vulnerability is classified as Low severity because exploitation requires Trivy to scan untrusted Terraform configurations with misconfiguration scanning enabled, and information disclosure is limited to files readable by the scanner process. Trivy typically runs in ephemeral CI/CD environments or as a local CLI tool under non-privileged accounts, limiting the blast radius. Standard container image scanning workflows are not affected.
Mitigation
Run Trivy in an ephemeral, unprivileged container or sandbox when scanning untrusted Terraform configurations. Avoid mounting sensitive host paths or exposing credentials via environment variables in the scanner's execution environment. Alternatively, inspect third-party pull requests before running misconfiguration scans against them.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 2.5 | N/A | 2.5 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | Low |
| User Interaction | Required | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
