Terraform 1.15.9 patches CVE-2026-14978 .terraformignore bypass

Mon, 24 Aug 2026 12:43:44 +0000

Platform/SRE — Plan: CVE-2026-14978 (Unicode normalization in go-slug) can cause files to leak into HCP Terraform/TFE runs despite .terraformignore rules; not KEV-listed and EPSS 0.00, but worth upgrading Terraform to 1.15.9 in the next maintenance window if you upload sensitive files via remote runs.
CI/CD — Plan: If pipelines run Terraform remote operations against HCP Terraform or Terraform Enterprise, the .terraformignore bypass in CVE-2026-14978 could leak secrets or config files into run uploads; pin Terraform to 1.15.9 in CI pipeline tooling during the next scheduled update.
Leader — Skip
Signals: CVE-2026-14978 — CISA KEV: not listed, EPSS 0.00

Patch on CuraDevOps