ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-64672

Terragrunt catalog predictable temp symlink clobber

Published Oct 15, 2026 · catalog updated Oct 15, 2026 · Terragrunt catalog predictable temp

Open the advisory

Exploitation likelihood is not on this record for CVE-2026-64672. A missing EPSS score is not a low risk. Compare Terragrunt catalog predictable temp with the linked advisory before you change production.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Terragrunt catalog predictable temp).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
  • EPSS is missing. A missing score is not a low risk.
Severity
Medium—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
Not in the current FIRST EPSS dataset
Remediation
Version ranges on file
Affected products
Go github.com/gruntwork-io/terragrunt · go github.com/gruntwork-io/terragrunt · golang github.com

### Summary Terragrunt's command clones each repository referenced in your catalog configuration into a temporary working directory. In affected versions, the clone path it derived was deterministic and sat under the shared system temporary directory, in the form . Because that path was predictable and Terragrunt followed a symlink already present there instead of rejecting it, a local attacker could plant a symlink at that path and cause Terragrunt to delete a directory and re-clone into it outside the intended temporary root. ### Impact This affected users who ran on a host they shared with other local users or processes they did not fully trust, such as a multi-user server or a shared CI runner. The attack required a local attacker: a separate local user or process able to write to the shared system temporary directory. It was not remotely exploitable, and the victim had to run while the attacker's symlink was already in place. Because the predictable path depended only on the repository URL being cataloged and the location of the system temporary directory, the attacker could compute it in advance and plant a symlink there before the victim ran the command. When the victim ran , Terragrunt followed the symlink out of the intended temporary root, deleted an existing directory under the attacker-chosen parent, and repopulated that path with the cloned repository contents. All of this happened in the security context of the user running Terragrunt. The attacker controlled the parent directory the symlink pointed to, but not the leaf name: the leaf was fixed to , derived from the repository URL the victim cataloged. The primitive was deletion of an existing directory outside the temporary root, followed by a re-clone into that same path. On a single-user machine with no hostile local processes, exposure was minimal. ### Affected Versions - Terragrunt ### Patches This vulnerability has been resolved in Terragrunt version . All users are strongly advised to upgrade. #

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/gruntwork-io/terragrunt0 → 1.1.1
  • go github.com/gruntwork-io/terragrunt< 1.1.1
  • golang github.comversion unspecified

How to fix CVE-2026-64672

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Exploitation likelihood is not on this record for CVE-2026-64672. A missing EPSS score is not a low risk. Compare Terragrunt catalog predictable temp with the linked advisory before you change production.

Which versions are affected?

Compare what you have installed with 0 → 1.1.1, < 1.1.1. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-377; CWE-59: Link Following. EPSS is absent from the current FIRST dataset. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2026 · GitHub Advisory Database

    Detected

    ### Summary Terragrunt's command clones each repository referenced in your catalog configuration into a temporary working directory. In affected versions, the clone path it derived was deterministic and sat under the shared system temporary directory, in the form . Because that path was predictable and Terragrunt followed a symlink already present there instead of rejecting it, a local attacker co

  2. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ### Summary Terragrunt's command clones each repository referenced in your catalog configuration into a temporary working directory. In affected versions, the clone path it derived was deterministic and sat under the shared system temporary directory, in the form . Because that path was predictable and Terragrunt followed a symlink already present there instead of rejecting it, a local attacker co

  3. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    github.com/gruntwork-io/terragrunt fixed in 1.1.1

  4. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    github.com/gruntwork-io/terragrunt fixed in 1.1.1

  5. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ### Summary Terragrunt's command clones each repository referenced in your catalog configuration into a temporary working directory. In affected versions, the clone path it derived was deterministic and sat under the shared system temporary directory, in the form . Because that path was predictable and Terragrunt followed a symlink already present there instead of rejecting it, a local attacker co

Sources

  • CVE.orgVulnerability recordCVE-2026-64672

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-wv6g-x823-wx9m

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-64672

    Terragrunt's terragrunt catalog command clones each repository referenced in your catalog configuration into a temporary working directory. In affected versions, the clone path it derived was deterministic and sat under the shared system temporary directory, in the form /catalog- . Because that path was predictable and Terragrunt followed a symlink already present there instead of rejecting it, a

    advisories.gitlab.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-wv6g-x823-wx9m

    Terragrunt catalog predictable temp symlink clobber

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.