CVE-2026-14468

{
  "id": "CVE-2026-14468",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-06T21:16:53.000",
  "lastModified": "2026-10-25T20:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion of registry modules that did not correctly enforce the intended boundary on packaged module content. This may allow an authenticated user to include files from outside the intended repository content in a module and then download them, potentially exposing sensitive files readable by the ingestion process. This vulnerability, CVE-2026-14468, is fixed in Terraform Enterprise v2.0.4 and v1.2.4."
    },
    {
      "lang": "es",
      "value": "HashiCorp Terraform Enterprise presentaba un problema en su ingesta de módulos de registro del sistema de control de versiones (VCS) que no aplicaba correctamente el límite previsto en el contenido del módulo empaquetado. Esto podría permitir a un usuario autenticado incluir archivos de fuera del contenido previsto del repositorio en un módulo y luego descargarlos, exponiendo potencialmente archivos sensibles legibles por el proceso de ingesta. Esta vulnerabilidad, CVE-2026-14468, está corregida en Terraform Enterprise v2.0.4 y v1.2.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "HashiCorp",
          "product": "Terraform Enterprise",
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "versions": [
            {
              "version": "1.0.0",
              "lessThan": "2.0.4",
              "versionType": "semver",
              "status": "affected",
              "changes": [
                {
                  "at": "1.2.4",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-07T13:52:23.618304Z",
          "id": "CVE-2026-14468",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://discuss.hashicorp.com/t/hcsec-2026-17-terraform-enterprise-vulnerable-to-arbitrary-file-read/77549",
      "source": "[email protected]"
    }
  ]
}