Symlink following in Terragrunt catalog clones temp directory
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Terragrunt before 1.1.1 derives a predictable per-repository catalog clone root under the shared system temporary directory when running the catalog command. A local attacker who can write to that directory and predict the cataloged repository can place a symlink at that path, because the tool follows it. This causes a repository-named directory of the victim to be deleted and replaced, when the victim runs terragrunt catalog on a shared host while the symlink is present. The flaw is tracked under CWE-59, and the attack is not remotely exploitable.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink already placed at that path. A local attacker who can write to the temporary directory and predict the cataloged repository can redirect cleanup and cloning outside the intended root, causing an existing repository-named directory to be deleted and replaced in the victim's security context. The attack requires the victim to run terragrunt catalog on a shared host while the symlink is present, and it is not remotely exploitable. This issue is fixed in version 1.1.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| gruntwork-io | terragrunt | before 1.1.1 | 1.1.1 | Patch available | CNA |
| — | github.com/gruntwork-io/terragrunt (Go) | before 1.1.1 | 1.1.1 | Patch available | GHSA-wv6g-x823-wx9m |
- terragrunt Vendorgruntwork-io Affected before 1.1.1 Fixed in 1.1.1 Patch available CNA
- github.com/gruntwork-io/terragrunt (Go) Vendor— Affected before 1.1.1 Fixed in 1.1.1 Patch available GHSA-wv6g-x823-wx9m
Remediation
Update Terragrunt to version 1.1.1, which fixes the issue for the gruntwork-io/terragrunt product and the github.com/gruntwork-io/terragrunt Go module.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
- Fix · CNA terragrunt (gruntwork-io) Fixed in 1.1.1
- Fix · GHSA-wv6g-x823-wx9m github.com/gruntwork-io/terragrunt (Go) Fixed in 1.1.1 Advisory →
Timeline
- 2026-11-03 Threatist record created from CVE-2026-64672
- 2026-11-07 CISA SSVC decision points changed
References
Other 5
- https://github.com/gruntwork-io/terragrunt/security/advisories/GHSA-wv6g-x823-wx9m
- https://github.com/gruntwork-io/terragrunt/pull/6438
- https://github.com/gruntwork-io/terragrunt/commit/668891c5a2ad2996f134bb8b00098754674ea94a
- https://github.com/gruntwork-io/terragrunt/releases/tag/v1.1.1
- https://github.com/gruntwork-io/terragrunt
More gruntwork-io vulnerabilities
- TI-2026-32939 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest CVSS 4.0MEDIUM 6.9
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences