{"id":"CVE-2026-64672","kind":"vulnerability","aliases":["CVE-2026-64672","GHSA-wv6g-x823-wx9m","GO-2026-6768"],"related":[],"title":"Terragrunt catalog predictable temp symlink clobber in github.com/gruntwork-io/terragrunt","description":"Terragrunt catalog predictable temp symlink clobber in github.com/gruntwork-io/terragrunt","summary":"Terragrunt's catalog feature creates a temporary symlink at a predictable path, so a local user on the same machine could pre-create that path and make Terragrunt overwrite or clobber a file of their choosing. The sources do not give the exact impact beyond that.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/gruntwork-io/terragrunt","fixed":["1.1.1"],"affected":"< 1.1.1","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","infrastructure-as-code","package","terragrunt"],"not_affected_if":["catalog-feature-unused","version-1.1.1-or-later"],"how_to_check":"Run terragrunt --version and check whether it is older than 1.1.1.","fix":"Upgrade github.com/gruntwork-io/terragrunt to 1.1.1 or later.","status":"open","published_at":"2026-10-19T21:08:35+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:15:22+00:00","updated_at":"2026-10-23T20:15:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:15:22Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/gruntwork-io/terragrunt to 1.1.1 or later.\nunknown","summary":"Terragrunt's catalog feature creates a temporary symlink at a predictable path, so a local user on the same machine could pre-create that path and make Terragrunt overwrite or clobber a file of their choosing. The sources do not give the exact impact beyond that.","category":"package","who_cares":["terragrunt","go","infrastructure-as-code"],"confidence":0.6,"analyst_note":"Sources list only the govuln entry at pkg.go.dev/vuln/GO-2026-6768; confirm the attack preconditions and whether the catalog feature is required to be exploitable.","how_to_check":"Run terragrunt --version and check whether it is older than 1.1.1.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["version-1.1.1-or-later","catalog-feature-unused"],"severity_if_unknown":"low"},"cost_usd":0.000372,"input_tokens":2008,"output_tokens":342,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,20A,23A '-64672':13A,24A '-6768':21A '/gruntwork-io/terragrunt':10A,27A,90C 'beyond':80B 'catalog':2A,37B,82C 'choos':71B 'clobber':6A,66B,86C 'code':32B 'could':55B 'creat':39B,58B 'cve':11A,22A 'exact':78B 'featur':38B 'file':68B 'ghsa':15A 'ghsa-wv6g-x823-wx9m':14A 'github.com':9A,26A,89C 'github.com/gruntwork-io/terragrunt':8A,25A,88C 'give':76B 'go':19A,28B 'impact':79B 'infrastructur':30B 'infrastructure-as-cod':29B 'local':49B 'machin':54B 'make':62B 'overwrit':64B 'packag':33B 'path':46B,60B 'pre':57B 'pre-creat':56B 'predict':3A,45B,83C 'sourc':73B 'symlink':5A,42B,85C 'temp':4A,84C 'temporari':41B 'terragrunt':1A,34B,35B,63B,81C 'user':50B 'wv6g':16A 'wx9m':18A 'x823':17A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:08:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6768","url":"https://pkg.go.dev/vuln/GO-2026-6768","severity":null,"published_at":"2026-10-19T21:08:35+00:00","modified_at":"2026-10-19T21:08:35+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}