CVE-2026-64672— Terragrunt catalog predictable temp symlink clobber

Quick assessment

Affected

gruntwork-io terragrunt

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Terragrunt 是一款灵活的编排工具，支持将使用 OpenTofu 或 Terraform 编写的“基础设施即代码”（IaC）方案进行规模化部署。在 1.1.1 版本之前，命令会在共享系统临时目录下生成一个可预测的、按仓库划分的目录克隆根路径，并会跟随该路径上已存在的符号链接。若攻击者能够向该临时目录写入文件，并能预测目标仓库的名称，则可将清理和克隆操作重定向到预期根目录之外，导致以仓库名称命名的现有目录在受害者的安全上下文中被删除并替换。该攻击需要受害者在存在符号链接的共享主机上运行命令，且无法通过远程

CVSS 4.4 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1565.002 · Transmitted Data Manipulation T1565.001 · Stored Data Manipulation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Terragrunt catalog predictable temp symlink clobber

Source: CVE Program / CVE List V5

Vulnerability Description

Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink already placed at that path. A local attacker who can write to the temporary directory and predict the cataloged repository can redirect cleanup and cloning outside the intended root, causing an existing repository-named directory to be deleted and replaced in the victim's security context. The attack requires the victim to run terragrunt catalog on a shared host while the symlink is present, and it is not remotely exploitable. This issue is fixed in version 1.1.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

在文件访问前对链接解析不恰当(链接跟随)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
gruntwork-io	terragrunt	< 1.1.1	-

II. Public POCs for CVE-2026-64672

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-64672

请登录查看更多情报信息。

Other References for CVE-2026-64672 (4)

https://github.com/gruntwork-io/terragrunt/pull/6438 x_refsource_MISC
https://github.com/gruntwork-io/terragrunt/releases/tag/v1.1.1 x_refsource_MISC
https://github.com/gruntwork-io/terragrunt/security/advisories/GHSA-wv6g-x823-wx9m x_refsource_CONFIRM
https://github.com/gruntwork-io/terragrunt/commit/668891c5a2ad2996f134bb8b00098754674ea94a x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-64672

IV. Related Vulnerabilities

Same product: terragrunt

CVE-2026-45099
Terragrunt: Arbitrary File Deletion via Malicious Module Man

Same vendor: gruntwork-io

CVE-2026-45099
Terragrunt: Arbitrary File Deletion via Malicious Module Man

Same weakness: CWE-59