Hashicorp Terraform vulnerabilities

5 CVEs affecting Hashicorp Terraform, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-13432, published 2025-11-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-9057, published 2018-03-27. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for…
CVE-2019-19316, published 2019-12-02. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.
CVE-2021-36230, published 2021-07-20. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. HashiCorp Terraform Enterprise releases up to v202106-1 did not properly perform authorization checks on a subset of API requests executed using the run token, allowing privilege escalation to…
CVE-2023-4782, published 2023-09-08. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the `init` operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.
CVE-2025-13432, published 2025-11-21. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent…