Plan
active
Terraform 1.15.9 patches CVE-2026-14978 .terraformignore bypass
- Platform/SRE — Plan: CVE-2026-14978 (Unicode normalization in go-slug) can cause files to leak into HCP Terraform/TFE runs despite .terraformignore rules; not KEV-listed and EPSS 0.00, but worth upgrading Terraform to 1.15.9 in the next maintenance window if you upload sensitive files via remote runs.
- CI/CD — Plan: If pipelines run Terraform remote operations against HCP Terraform or Terraform Enterprise, the .terraformignore bypass in CVE-2026-14978 could leak secrets or config files into run uploads; pin Terraform to 1.15.9 in CI pipeline tooling during the next scheduled update.
- Leader — Skip
- Signals: CVE-2026-14978 — CISA KEV: not listed, EPSS 0.00
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.