GO-2026-6768: Terragrunt catalog predictable temp symlink clobber
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink already placed at that path. A local attacker who can write to the temporary directory and predict the cataloged repository can redirect cleanup and cloning outside the intended root, causing an existing repository-named directory to be deleted and replaced in the victim's security context. The attack requires the victim to run terragrunt catalog on a shared host while the symlink is present, and it is not remotely exploitable. This issue is fixed in version 1.1.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
terragruntto a version that resolves this vulnerability.Fixed in 1.1.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running the terragrunt catalog command on a shared host are exposed if another local user can write to the shared system temporary directory. The issue is not remotely exploitable.
What does an attacker need to exploit it?
The attacker needs local access sufficient to place a symlink in the temporary directory and must be able to predict the repository being cataloged. The victim must then run terragrunt catalog while that symlink is present.
What can happen if exploitation succeeds?
Cleanup and cloning can be redirected outside the intended temporary clone root. An existing directory named after the repository can be deleted and replaced using the victim's security context.
What should teams do if they cannot upgrade immediately?
Avoid running terragrunt catalog on shared hosts where untrusted local users can write to the system temporary directory. This reduces the opportunity for a local attacker to pre-place the required symlink.
Which version fixes the issue?
The issue is fixed in Terragrunt version 1.1.1. Versions prior to 1.1.1 are affected.