CVE-2025-13432
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Terraform Enterprise versions prior to 1.1.1 and 1.0.3 allow a user with specific but insufficient permissions to create state versions in a workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied.
Risk Assessment
The risk involves potential unauthorized modification of infrastructure, which could lead to service disruptions, security breaches, or costly configuration errors.
Recommendation
It is recommended to immediately update Terraform Enterprise to version 1.1.1 or 1.0.3 and review user permissions in workspaces.
Other vulnerabilities in Terraform Enterprise
See all- CVE-2026-14468High
HashiCorp Terraform Enterprise had an issue in its VCS ingestion of registry modules that did not correctly enforce the intended boundary on packaged module content. This allowed an authenticated user to include files from outside the intended repository content in a module and then download them, potentially exposing sensitive files readable by the ingestion process.
- CVE-2023-3114Medium
Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the same organization.
Original NVD description (English source)
Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied. This vulnerability, CVE-2025-13432, is fixed in Terraform Enterprise version 1.1.1 and 1.0.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS