Terragrunt Vulnerability Highlights the Need for Secure IaC Toolchains

A new vulnerability, CVE-2026-64672, has been identified in Terragrunt, a popular orchestration tool for OpenTofu and Terraform. The flaw, present in versions prior to 1.1.1, allows a local attacker with write access to the system's temporary directory to exploit a predictable per-repository catalog clone root. By placing a symlink at this path, an attacker could redirect cleanup and cloning operations outside their intended scope, potentially leading to the deletion and replacement of existing repository-named directories in the victim's security context. The attack requires the victim to execute `terragrunt catalog` on a shared host while the malicious symlink is present and is not remotely exploitable. This vulnerability matters significantly to DevOps and platform engineering teams leveraging Terragrunt for managing their infrastructure. It highlights a critical, often overlooked, aspect of IaC security: the security of the tools themselves. While much focus is rightly placed on securing the IaC code and its deployment pipelines, vulnerabilities in the underlying tooling can create unexpected attack vectors. The potential for data loss or unauthorized repository manipulation can disrupt deployments, compromise infrastructure integrity, and introduce compliance risks. Practitioners using Terragrunt should prioritize upgrading to version 1.1.1 immediately to mitigate this risk. This incident fits into a broader, well-established trend in cloud and DevOps: the increasing importance of supply chain security. Just as application development has seen a rise in concerns around compromised libraries and build systems, IaC environments are equally susceptible. As organizations increasingly rely on automated tools to provision and manage their infrastructure, the attack surface expands to include these tools and their dependencies. This Terragrunt vulnerability serves as a reminder that every component in the IaC toolchain, from the core IaC language to orchestration layers and CI/CD pipelines, must be subject to rigorous security scrutiny and continuous patching. The industry has seen a growing emphasis on software supply chain security, with initiatives like SBOMs (Software Bill of Materials) and stricter vulnerability management practices becoming standard. In practice, this means that practitioners should not only keep their IaC code secure but also maintain a vigilant approach to the security of their IaC tooling. This includes subscribing to security advisories for all tools in their stack, implementing automated vulnerability scanning for their build environments, and ensuring timely application of patches. For Terragrunt users, verifying that all instances are running version 1.1.1 or later is paramount. Furthermore, this incident reinforces the need for robust access controls and least-privilege principles, especially in shared development or CI/CD environments, to limit the impact of any potential local exploits. Teams should also consider the broader implications for their IaC security posture, including regular audits of their toolchain and dependency management practices.