CVE-2026-45099 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
A malicious module manifest allows arbitrary file deletion outside the cache, disrupting CI/CD pipelines and removing local source code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45099?
CVE-2026-45099 is a medium-severity path traversal vulnerability in gruntwork-io terragrunt, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean() in internal/util/file.go. A malicious or compromised external module can place absolute or traversal paths in the manifest, causing cleanup to delete files outside the module cache that are accessible to the Terragrunt process before OpenTofu or Terraform executes. This deletion-only primitive can remove local source code or configuration and disrupt CI/CD pipelines. This issue is fixed in version 1.0.4.
Weakness: CWE-22
Which versions are affected by CVE-2026-45099?
3 open source packages ship an affected version, including github.com/gruntwork-io/terragrunt.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gruntwork-io/terragrunt Go | All versions | 1.0.4 |
github.com/gruntwork-io/terragrunt Go | All versions | 1.0.4 |
github.com/gruntwork-io/terragrunt Go | All versions | 1.0.4 |
How do I fix CVE-2026-45099?
Upgrade github.com/gruntwork-io/terragrunt to 1.0.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-45099 being exploited?
There is no known exploitation of CVE-2026-45099 in the wild and no public exploit code.
Sources
Also known as GHSA-8394-6f8r-whxg, GO-2026-6241, MINI-hrq6-h952-wpqg, MINI-pv3f-2886-3ghh.