CVE-2021-40862: Hashicorp Terraform Enterprise

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

HashiCorp Terraform Enterprise up to v202108-1 contained an API endpoint that erroneously disclosed a sensitive URL to authenticated parties, which could be used for privilege escalation or unauthorized modification of a Terraform configuration. Fixed in v202109-1.

Affected products

• Hashicorp Terraform Enterprise: up to and including 202108-1

Published 2021-09-15. Last modified 2026-06-17.