What is CVE-2026-14978?

CVE-2026-14978 is a medium-severity vulnerability in Hashicorp Go-Slug, classified under CWE-176. CVSS score: 5.5/10. Published 2026-08-19.

How severe is CVE-2026-14978?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Vulnerability in Hashicorp Go-Slug

CVE-2026-14978

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.

Affected products

Hashicorp Go-slug

Weakness classification (CWE)

CWE-176

References

psirt@us.ibm.com (vendor-advisory, patch)

Frequently asked questions

What is CVE-2026-14978?: CVE-2026-14978 is a medium-severity vulnerability in Hashicorp Go-Slug, classified under CWE-176. CVSS score: 5.5/10. Published 2026-08-19.
How severe is CVE-2026-14978?: Medium severity. CVSS v3 base score is 5.5 out of 10.