HashiCorp Terraform security vulnerabilities
Open-source infrastructure. Public CVE monitoring for HashiCorp Terraform. Vendor security advisories are linked on this page.
Built for Operators of this product.
18 public records · 0 security-fix timeline events. 0 published in the last 7 days. 9 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 1
- High 4
- Medium 0
- Low 0
2026-08-095 issues2026-11-06
Known exploited
View all known exploitedNo records match this view.
Recently published
Browse catalog- High8.8Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during planCheck if you run itEPSS 0.47%Oct 27, 2026
- High7.1CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive valuesCheck if you run itEPSS 0.38%Oct 27, 2026
- Critical9.9Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator.Check if you run itEPSS 0.46%Oct 26, 2026
- High8.4CVE-2026-115414 - OS Command Injection Issue in SAM CLI Terraform HookCheck if you run itEPSS 0.88%Oct 22, 2026
- High7.8mise manages dev tools like node, python, cmake, and terraform.Check if you run itEPSS 0.26%Oct 14, 2026
- High7.8mise manages dev tools like node, python, cmake, and terraform.Check if you run itEPSS 0.17%Apr 7, 2026
- High8.5tfplan2md is software for converting Terraform plan JSON files into human-readable Markdown reports.Check if you run itEPSS 0.34%Feb 25, 2026
- High8.7Terraform / OpenTofu Provider adds support for Proxmox Virtual Environment.Check if you run itEPSS 0.48%Feb 4, 2026
- High7.4OpenOps before 0.6.11 allows remote code execution in the Terraform block.Check if you run itEPSS 0.23%Dec 24, 2025
- High7.4Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration.Check if you run itEPSS 0.53%Nov 21, 2025