Medium severity5.5NVD Advisory· Published Aug 19, 2026· Updated Sep 4, 2026
CVE-2026-14978
CVE-2026-14978
Description
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
28- osv-coords27 versionspkg:apk/chainguard/vault-fips-1.21pkg:apk/chainguard/terraform-1.13pkg:apk/chainguard/vault-fips-2.1pkg:apk/chainguard/opentofu-fips-1.10pkg:apk/chainguard/opentofu-1.9pkg:apk/chainguard/helmfilepkg:apk/chainguard/opentofu-1.11pkg:apk/chainguard/opentofu-fips-1.11pkg:apk/chainguard/opentofu-fips-1.9pkg:apk/chainguard/terraform-fips-1.13pkg:apk/chainguard/opentofu-fips-1.12pkg:apk/chainguard/terraform-mcp-serverpkg:apk/chainguard/vault-1.21pkg:apk/chainguard/vault-2.0pkg:apk/chainguard/vault-2.1pkg:apk/chainguard/vault-fips-2.0pkg:apk/wolfi/opentofu-1.10pkg:apk/wolfi/opentofu-1.11pkg:apk/wolfi/opentofu-1.12pkg:apk/wolfi/opentofu-1.9pkg:apk/wolfi/terraform-mcp-serverpkg:apk/chainguard/opentofu-1.10pkg:apk/chainguard/terraformpkg:apk/chainguard/terraform-fips-1.14pkg:apk/wolfi/terraformpkg:apk/chainguard/opentofu-1.12pkg:apk/chainguard/terraform-ls
< 1.21.4-r18+ 26 more
- (no CPE)range: < 1.21.4-r18
- (no CPE)range: < 1.13.5-r28
- (no CPE)range: < 2.1.0-r3
- (no CPE)range: < 1.10.10-r16
- (no CPE)range: < 1.9.4-r30
- (no CPE)range: < 1.7.4-r6
- (no CPE)range: < 1.11.14-r5
- (no CPE)range: < 1.11.14-r4
- (no CPE)range: < 1.9.4-r35
- (no CPE)range: < 1.13.5-r35
- (no CPE)range: < 1.12.6-r6
- (no CPE)range: < 1.3.0-r3
- (no CPE)range: < 1.21.4-r18
- (no CPE)range: < 2.0.4-r5
- (no CPE)range: < 2.1.0-r3
- (no CPE)range: < 2.0.4-r4
- (no CPE)range: < 1.10.10-r20
- (no CPE)range: < 1.11.14-r5
- (no CPE)range: < 1.12.6-r5
- (no CPE)range: < 1.9.4-r30
- (no CPE)range: < 1.3.0-r3
- (no CPE)range: < 1.10.10-r20
- (no CPE)range: < 1.5.7-r61
- (no CPE)range: < 1.14.9-r20
- (no CPE)range: < 1.5.7-r61
- (no CPE)range: < 1.12.6-r5
- (no CPE)range: < 0.39.0-r5
Patches
Vulnerability mechanics
References
1- www.ibm.com/support/pages/node/7284170nvdVendor Advisory
News mentions
0No linked articles in our index yet.