CVE-2021-36230 Missing authorization in n/a
Attackers can escalate privileges to organization owner via run tokens due to missing authorization checks in Terraform Enterprise API requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-36230?
CVE-2021-36230 is a high-severity missing authorization vulnerability in n/a, published on 20 Jul 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
HashiCorp Terraform Enterprise releases up to v202106-1 did not properly perform authorization checks on a subset of API requests executed using the run token, allowing privilege escalation to organization owner. Fixed in v202107-1.
Weakness: CWE-863
Which versions are affected by CVE-2021-36230?
It affects 1 product.
Products include Hashicorp Terraform.
How do I fix CVE-2021-36230?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-36230 being exploited?
There is no known exploitation of CVE-2021-36230 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2018-9057 HashiCorp Terraform Amazon Web Services (AWS) uses an insecure PRNG
- CVE-2019-19316 Use of a Broken or Risky Cryptographic Algorithm in Terraform
- CVE-2023-4782 Terraform Allows Arbitrary File Write During Init Operation
- CVE-2025-13432 Terraform Enterprise state versions can be created by users with specific permissions without sufficient write access
Sources
Also known as AZL-9180, GHSA-6cgg-f8v8-8rxw.