CVE-2026-64672 gruntwork-io CVE debrief

Who should care

Users running Terragrunt in shared environments, such as multi-user servers or shared CI runners, should assess exposure and prioritize remediation. Local attackers may delete directories outside the intended temporary root and re-clone repositories outside the intended temporary root. Verify Terragrunt version and configuration to prevent exploitation and prioritize remediation for affected Terragrunt versions.

Why it matters

Terragrunt's predictable temp symlink clobber vulnerability affects users running `terragrunt catalog` in shared environments. Local attackers can exploit this vulnerability to delete and re-clone directories. Assess exposure, prioritize remediation, and verify inventory of Terragrunt installations.

• Local attackers may delete directories outside the intended temporary root
• Local attackers may re-clone repositories outside the intended temporary root
• Verify Terragrunt version and configuration to prevent exploitation
• Remediation priority for affected Terragrunt versions

Technical summary

Terragrunt's `terragrunt catalog` command clones repositories into a temporary directory with a predictable path. A local attacker can plant a symlink at this path, causing Terragrunt to delete a directory and re-clone into it outside the intended temporary root. This requires a local attacker with write access to the shared system temporary directory. The predictable path depends on the repository URL being cataloged and the location of the system temporary directory. Users running `terragrunt catalog` on a shared host with untrusted local users or processes should assess exposure and prioritize remediation.

Defensive priority

Assess exposure and prioritize remediation for Terragrunt deployments in shared environments.

Recommended defensive actions

• Assess exposure of Terragrunt deployments in shared environments
• Prioritize remediation for affected Terragrunt versions
• Verify inventory of Terragrunt installations
• Monitor for suspicious activity in shared environments
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the predictable temp symlink clobber vulnerability in Terragrunt's `terragrunt catalog` command. This vulnerability allows a local attacker to plant a symlink and cause Terragrunt to delete a directory and re-clone into it outside the intended temporary root. The attack requires a local attacker with write access to the shared system temporary directory. Users should verify their Terragrunt installations and configurations to prevent exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.