CVE-2026-14978
Description
A flaw was found in go-slug. A local attacker could bypass .terraformignore exclusions, leading to sensitive files being included in Terraform slug uploads. This is caused by improper handling of Unicode normalization during path matching.
Statement
A flaw was found in go-slug versions 0.4.0 through 0.18.2. When Terraform Cloud or Terraform Enterprise configuration uploads are created from a filesystem presenting affected Unicode normalization behavior, a local attacker who can control non-ASCII filenames in the working directory may bypass .terraformignore rules and cause excluded sensitive files to be uploaded. Red Hat products that do not exercise this upload path or ship go-slug 0.18.3 or later are not affected.
Mitigation
Upgrade to go-slug 0.18.3 or later. Where an immediate upgrade is not possible, do not rely on `.terraformignore` as a security boundary: keep sensitive files outside the uploaded working directory and avoid canonically equivalent non-ASCII filenames and ignore patterns on filesystems that normalize filenames.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | 5.5 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | Low | Low | Low |
| Privileges Required | None | Low | None |
| User Interaction | Required | None | Required |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | High | High | High |
| Integrity Impact | None | None | None |
| Availability Impact | None | None | None |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality,Integrity,Access Control
Technical Impact: Read Files or Directories; Modify Files or Directories; Bypass Protection Mechanism
An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism than an attacker may be able to bypass the mechanism.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
