v1.16.1
2026-09-03T08:51:36Z•69421832a449112787724a35b90d2728241ebc04642f70ca7ef3bcf09658ac45
CVE-2026-14978HCP TerraformHashiCorp TerraformTerraform CLITerraform EnterpriseUnicode normalizationcloud automationdependency updatefile upload exposureinfrastructure-as-coderelease notesterraformignore
What happened
HashiCorp Terraform release feed covering versions 1.15.9 through 1.16.1 and 1.17.0 alpha builds. Release 1.15.9 includes a security-relevant dependency update to go-slug v0.18.3 mitigating CVE-2026-14978, a Unicode normalization issue that could cause files intended to be excluded by .terraformignore to be uploaded to Terraform Enterprise or HCP Terraform during runs. Other entries primarily contain feature additions, validation fixes, panic fixes, and stability improvements.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- hashicorp_terraform_releases
- Record identifier
- 69421832a449112787724a35b90d2728241ebc04642f70ca7ef3bcf09658ac45
- Enrichment time
- 2026-09-03T08:51:36Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.