# \#security-terraform **URL:** https://discuss.hashicorp.com/tag/security-terraform/76.md [Latest](https://discuss.hashicorp.com/latest.md) · [Categories](https://discuss.hashicorp.com/categories.md) · [Tags](https://discuss.hashicorp.com/tags.md) --- ## [HCSEC-2026-31 - Go-slug vulnerable to exclusion bypass in .terraformignore handling](https://discuss.hashicorp.com/t/hcsec-2026-31-go-slug-vulnerable-to-exclusion-bypass-in-terraformignore-handling/77668)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [August 20, 2026, 7:40pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-31-go-slug-vulnerable-to-exclusion-bypass-in-terraformignore-handling/77668 "2026-08-20T19:40:14Z")
Bulletin ID: HCSEC-2026-31 Affected Products / Versions: github.com/hashicorp/go-slug v0.4.0 through v0.18.2; fixed in v0.18.3. Publication Date: August 20, 2026 Summary The github.com/hashicorp/go-slug library befor… --- ## [HCSEC-2026-23 - Multiple vulnerabilities impacting HashiCorp Terraform MCP Server](https://discuss.hashicorp.com/t/hcsec-2026-23-multiple-vulnerabilities-impacting-hashicorp-terraform-mcp-server/77606)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [July 28, 2026, 5:50pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-23-multiple-vulnerabilities-impacting-hashicorp-terraform-mcp-server/77606 "2026-07-28T17:50:43Z")
Bulletin ID: HCSEC-2026-23 Affected Products / Versions: terraform-mcp-server 0.2.1 up to and including 1.0.0; fixed in 1.1.0. Publication Date: July 28, 2026 Summary The terraform-mcp-server before version 1.1.0 is … --- ## [HCSEC-2026-17 - Terraform Enterprise vulnerable to arbitrary file read](https://discuss.hashicorp.com/t/hcsec-2026-17-terraform-enterprise-vulnerable-to-arbitrary-file-read/77549)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [July 6, 2026, 8:55pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-17-terraform-enterprise-vulnerable-to-arbitrary-file-read/77549 "2026-07-06T20:55:01Z")
Bulletin ID: HCSEC-2026-17 Affected Products / Versions: Terraform Enterprise v202506-1, v202507-1, and 1.0.0 through 2.0.3; fixed in Terraform Enterprise 2.0.4, 1.2.4. Publication Date: July 6, 2026 Summary HashiCor… --- ## [HCSEC-2026-09 - Remediation and Improved Secret Management for GitHub Webhook Secret Exposure](https://discuss.hashicorp.com/t/hcsec-2026-09-remediation-and-improved-secret-management-for-github-webhook-secret-exposure/77357)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [April 20, 2026, 2:21pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-09-remediation-and-improved-secret-management-for-github-webhook-secret-exposure/77357 "2026-04-20T14:21:35Z")
Bulletin ID: HCSEC-2026-09 Publication Date: April 20, 2026 Target Audience: All HCP Terraform and Terraform Enterprise customers using GitHub integrations for Version Control System (VCS) workflows. Executive Summary … --- ## [HCSEC-2025-33 - Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method](https://discuss.hashicorp.com/t/hcsec-2025-33-vault-terraform-provider-applied-incorrect-defaults-for-ldap-auth-method/76822)
**Author:** [@mickael](https://discuss.hashicorp.com/u/mickael)\ **Replies:** 0\ **Last updated:** [November 21, 2025, 2:23pm UTC](https://discuss.hashicorp.com/t/hcsec-2025-33-vault-terraform-provider-applied-incorrect-defaults-for-ldap-auth-method/76822 "2025-11-21T14:23:44Z")
Bulletin ID: HCSEC-2025-33 Affected Products / Versions: Vault Terraform Provider from v4.2.0 up to v5.4.0, fixed in v5.5.0. Publication Date: November 21, 2025 Summary Vault’s Terraform Provider incorrectly set the … --- ## [HCSEC-2025-34 - Terraform Enterprise state versions can be created by users without sufficient write access](https://discuss.hashicorp.com/t/hcsec-2025-34-terraform-enterprise-state-versions-can-be-created-by-users-without-sufficient-write-access/76821)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [November 21, 2025, 2:13pm UTC](https://discuss.hashicorp.com/t/hcsec-2025-34-terraform-enterprise-state-versions-can-be-created-by-users-without-sufficient-write-access/76821 "2025-11-21T14:13:23Z")
Bulletin ID: HCSEC-2025-34 Affected Products / Versions: Terraform Enterprise up to 1.1.0, and 1.0.2; fixed in Terraform Enterprise 1.1.1, 1.0.3 Publication Date: November 21, 2025 Summary Terraform state versions ca… --- ## [HCSEC-2025-05 - Terraform Enterprise’s Single Sign-On and Ruby SAML’s CVE-2025-25291 and CVE-2025-25292](https://discuss.hashicorp.com/t/hcsec-2025-05-terraform-enterprise-s-single-sign-on-and-ruby-saml-s-cve-2025-25291-and-cve-2025-25292/73824)
**Author:** [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\ **Replies:** 0\ **Last updated:** [March 13, 2025, 11:20pm UTC](https://discuss.hashicorp.com/t/hcsec-2025-05-terraform-enterprise-s-single-sign-on-and-ruby-saml-s-cve-2025-25291-and-cve-2025-25292/73824 "2025-03-13T23:20:50Z")
Bulletin ID: HCSEC-2025-05 Affected Products / Versions: Terraform Enterprise up to v202502-1; fixed in v202502-2. Publication Date: March 13, 2025 Summary Terraform Enterprise’s single sign-on functionality is imple… --- ## [HCSEC-2024-19 - Terraform Enterprise’s Single Sign-On And Ruby SAML’s CVE-2024-45409](https://discuss.hashicorp.com/t/hcsec-2024-19-terraform-enterprise-s-single-sign-on-and-ruby-saml-s-cve-2024-45409/70203)
**Author:** [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\ **Replies:** 1\ **Last updated:** [October 21, 2024, 11:19pm UTC](https://discuss.hashicorp.com/t/hcsec-2024-19-terraform-enterprise-s-single-sign-on-and-ruby-saml-s-cve-2024-45409/70203 "2024-10-21T23:19:41Z")
Bulletin ID: HCSEC-2024-19 Affected Products / Versions: Terraform Enterprise up to v202408-1; fixed in v202409-1. Publication Date: September 24, 2024 Summary Terraform Enterprise’s single sign-on functionality is i… --- ## [HCSEC-2024-04 - Terraform Registry Module Supply Chain Security Improvements](https://discuss.hashicorp.com/t/hcsec-2024-04-terraform-registry-module-supply-chain-security-improvements/62815)
**Author:** [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\ **Replies:** 0\ **Last updated:** [February 15, 2024, 6:30pm UTC](https://discuss.hashicorp.com/t/hcsec-2024-04-terraform-registry-module-supply-chain-security-improvements/62815 "2024-02-15T18:30:43Z")
Bulletin ID: HCSEC-2024-04 Affected Products / Versions: Terraform Registry (https://registry.terraform.io/) Unaffected Products / Versions: Terraform Cloud and Terraform Enterprise’s private registry Publication Date… --- ## [HCSEC-2023-27 - Terraform Allows Arbitrary File Write During Init Operation](https://discuss.hashicorp.com/t/hcsec-2023-27-terraform-allows-arbitrary-file-write-during-init-operation/58082)
**Author:** [@eastebry](https://discuss.hashicorp.com/u/eastebry)\ **Replies:** 0\ **Last updated:** [September 8, 2023, 4:33pm UTC](https://discuss.hashicorp.com/t/hcsec-2023-27-terraform-allows-arbitrary-file-write-during-init-operation/58082 "2023-09-08T16:33:49Z")
Bulletin ID: HCSEC-2023-27 Affected Products / Versions: Terraform 1.0.8 through 1.5.6; fixed in 1.5.7. Publication Date: September 8, 2023 Summary Terraform 1.0.8 through 1.5.6 allows arbitrary file write during the… --- ## [HCSEC-2023-26 - Terraform’s Handling Of Duplicate Map Keys In Configurations May Have Security Implications](https://discuss.hashicorp.com/t/hcsec-2023-26-terraform-s-handling-of-duplicate-map-keys-in-configurations-may-have-security-implications/57613)
**Author:** [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\ **Replies:** 0\ **Last updated:** [August 24, 2023, 7:17pm UTC](https://discuss.hashicorp.com/t/hcsec-2023-26-terraform-s-handling-of-duplicate-map-keys-in-configurations-may-have-security-implications/57613 "2023-08-24T19:17:09Z")
Bulletin ID: HCSEC-2023-26 Affected Products / Versions: All Terraform releases to date. Publication Date: August 24, 2023 Summary A long-lived Terraform issue regarding silent replacement of map entries with duplica… --- ## [HCSEC-2023-19 - Terraform Enterprise, Docker Engine, and Go’s CVE-2023-24540](https://discuss.hashicorp.com/t/hcsec-2023-19-terraform-enterprise-docker-engine-and-go-s-cve-2023-24540/55536)
**Author:** [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\ **Replies:** 1\ **Last updated:** [June 28, 2023, 11:07pm UTC](https://discuss.hashicorp.com/t/hcsec-2023-19-terraform-enterprise-docker-engine-and-go-s-cve-2023-24540/55536 "2023-06-28T23:07:42Z")
Bulletin ID: HCSEC-2023-19 Affected Products / Versions: Terraform Enterprise up to v202303-1. Publication Date: June 28, 2023 Summary Up until June 2023, Docker Engine 20.10 was the highest release officially suppor… --- ## [HCSEC-2023-18 - Terraform Enterprise Agent Pool Controls Allowed Unauthorized Workspaces to Target an Agent Pool](https://discuss.hashicorp.com/t/hcsec-2023-18-terraform-enterprise-agent-pool-controls-allowed-unauthorized-workspaces-to-target-an-agent-pool/55329)
**Author:** [@eastebry](https://discuss.hashicorp.com/u/eastebry)\ **Replies:** 0\ **Last updated:** [June 22, 2023, 7:16pm UTC](https://discuss.hashicorp.com/t/hcsec-2023-18-terraform-enterprise-agent-pool-controls-allowed-unauthorized-workspaces-to-target-an-agent-pool/55329 "2023-06-22T19:16:47Z")
Bulletin ID: HCSEC-2023-18 Affected Products / Versions: Terraform Enterprise since v202207-1, fixed in v202306-1 Publication Date: June 22, 2023 Summary Terraform Enterprise since version v202207-1 did not properly … --- ## [HCSEC-2022-06 - Terraform Enterprise May Capture Sensitive Data In Logs](https://discuss.hashicorp.com/t/hcsec-2022-06-terraform-enterprise-may-capture-sensitive-data-in-logs/36174)
**Author:** [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\ **Replies:** 0\ **Last updated:** [February 24, 2022, 1:42am UTC](https://discuss.hashicorp.com/t/hcsec-2022-06-terraform-enterprise-may-capture-sensitive-data-in-logs/36174 "2022-02-24T01:42:28Z")
Bulletin ID: HCSEC-2022-06 Affected Products / Versions: Terraform Enterprise v202112-1 through v202201-2; fixed in v202202-1. Publication Date: February 23, 2022 Summary Terraform Enterprise was configured to log in… --- ## [HCSEC-2021-25 - Terraform Enterprise Configuration Versions API Discloses Sensitive URL](https://discuss.hashicorp.com/t/hcsec-2021-25-terraform-enterprise-configuration-versions-api-discloses-sensitive-url/29508)
**Author:** [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\ **Replies:** 0\ **Last updated:** [September 14, 2021, 10:33pm UTC](https://discuss.hashicorp.com/t/hcsec-2021-25-terraform-enterprise-configuration-versions-api-discloses-sensitive-url/29508 "2021-09-14T22:33:51Z")
Bulletin ID: HCSEC-2021-25 Affected Products / Versions: Terraform Enterprise up to v202108-1; fixed in v202109-1. Publication Date: September 14, 2021 Summary Terraform Enterprise versions up to v202108-1 included a… --- ## [HCSEC-2021-18 - Terraform Enterprise Allowed Privilege Escalation Via Run Token](https://discuss.hashicorp.com/t/hcsec-2021-18-terraform-enterprise-allowed-privilege-escalation-via-run-token/27070)
**Author:** [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\ **Replies:** 0\ **Last updated:** [July 20, 2021, 8:26pm UTC](https://discuss.hashicorp.com/t/hcsec-2021-18-terraform-enterprise-allowed-privilege-escalation-via-run-token/27070 "2021-07-20T20:26:43Z")
Bulletin ID: HCSEC-2021-18 Affected Products / Versions: Terraform Enterprise up to v202106-1; fixed in v202107-1. Publication Date: July 20, 2021 Summary Terraform Enterprise versions up to v202106-1 did not perform… --- ## [HCSEC-2021-12 - Codecov Security Event and HashiCorp GPG Key Exposure](https://discuss.hashicorp.com/t/hcsec-2021-12-codecov-security-event-and-hashicorp-gpg-key-exposure/23512)
**Author:** [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 10:55pm UTC](https://discuss.hashicorp.com/t/hcsec-2021-12-codecov-security-event-and-hashicorp-gpg-key-exposure/23512 "2021-05-04T22:55:48Z")
Bulletin ID: HCSEC-2021-12 Publication Date: April 22, 2021 Summary HashiCorp was impacted by a security incident with a third party (Codecov) that led to potential disclosure of sensitive information. As a result, th… --- ## [HCSEC-2021-11 - Terraform’s Vault Provider Did Not Correctly Configure Bound Labels for GCP Auth](https://discuss.hashicorp.com/t/hcsec-2021-11-terraform-s-vault-provider-did-not-correctly-configure-bound-labels-for-gcp-auth/23464)
**Author:** [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\ **Replies:** 0\ **Last updated:** [April 21, 2021, 8:35pm UTC](https://discuss.hashicorp.com/t/hcsec-2021-11-terraform-s-vault-provider-did-not-correctly-configure-bound-labels-for-gcp-auth/23464 "2021-04-21T20:35:38Z")
Bulletin ID: HCSEC-2021-11 Affected Products / Versions: Terraform’s Vault Provider (terraform-provider-vault); fixed in 2.19.1. Publication Date: April 21, 2021 Summary Terraform’s Vault Provider (terraform-provider… --- ## [HCSEC-2021-06 - Terraform Enterprise Organization-Level MFA Requirement Was Not Enforced](https://discuss.hashicorp.com/t/hcsec-2021-06-terraform-enterprise-organization-level-mfa-requirement-was-not-enforced/22401)
**Author:** [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\ **Replies:** 0\ **Last updated:** [March 23, 2021, 7:59pm UTC](https://discuss.hashicorp.com/t/hcsec-2021-06-terraform-enterprise-organization-level-mfa-requirement-was-not-enforced/22401 "2021-03-23T19:59:59Z")
Bulletin ID: HCSEC-2021-06 Affected Products / Versions: Terraform Enterprise, fixed in release v202103-1. Publication Date: 23 March, 2021 Summary Terraform Enterprise did not enforce the organization-level setting … --- ## [HCSEC-2020-15 - Terraform Enterprise Allowed Local Account Creation Bypassing SSO](https://discuss.hashicorp.com/t/hcsec-2020-15-terraform-enterprise-allowed-local-account-creation-bypassing-sso/18100)
**Author:** [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\ **Replies:** 0\ **Last updated:** [November 25, 2020, 8:15pm UTC](https://discuss.hashicorp.com/t/hcsec-2020-15-terraform-enterprise-allowed-local-account-creation-bypassing-sso/18100 "2020-11-25T20:15:09Z")
Bulletin ID: HCSEC-2020-15 Affected Products / Versions: Terraform Enterprise up to v202006-1; fixed in v202007-1. Publication Date: 2 July, 2020 Summary HashiCorp Terraform Enterprise up to v202006-1 contained a def…