CVE-2026-4660: 
Terraform Community vulnerability analysis and mitigation

CVE-2026-4660 is an arbitrary file read vulnerability in HashiCorp's go-getter library (v1 branch) that allows unauthenticated remote attackers to read arbitrary files from the file system by supplying a maliciously crafted URL during certain git operations. It affects all go-getter v1 releases up to and including v1.8.5; the go-getter/v2 branch and package are not affected. The vulnerability was disclosed on April 9, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, HashiCorp Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). During git-based download operations, go-getter v1 fails to adequately validate or sanitize attacker-controlled URLs, allowing a crafted URL to redirect or manipulate the underlying git operation in a way that causes the library to read and expose arbitrary files from the host file system. Exploitation requires no authentication, no privileges, and no user interaction — an attacker only needs to supply a malicious URL to a system or application that passes it to go-getter. A public proof-of-concept (Docker-based, using poc.sh and docker-compose.yml) demonstrates the vulnerability via both terraform init and direct go-getter update() code paths, including credential leakage in error output (GitHub Advisory, PoC Repository).

Successful exploitation allows an unauthenticated network attacker to read arbitrary files from the file system of any host running a vulnerable go-getter v1 application, with high confidentiality impact and no integrity or availability impact. Sensitive files such as credentials, private keys, configuration files, and secrets (e.g., Terraform state or .tfvars files) could be exfiltrated, potentially enabling lateral movement or privilege escalation in downstream infrastructure. Applications that process URLs from untrusted sources — such as Terraform, Infracost, and other HashiCorp ecosystem tools — are particularly at risk (GitHub Advisory, HashiCorp Advisory).

A functional, Docker-based proof-of-concept exploit is publicly available on GitHub, demonstrating real file exfiltration via both Terraform and direct go-getter invocation (PoC Repository). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.031% (0.016% per GitHub Advisory), placing it in a low percentile for near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available in Nessus (ID: 305826) and Qualys (ID: 6765854) (GitHub Advisory).

1. Reconnaissance: Identify applications or services that use HashiCorp go-getter v1.8.5 or earlier — common targets include Terraform, Infracost, and custom Go applications that accept user-supplied URLs for artifact retrieval.
2. Craft malicious URL: Construct a specially crafted git URL (e.g., a URL pointing to an attacker-controlled git server or repository) designed to manipulate go-getter's git operation path traversal or reference handling to target a sensitive local file (e.g., /etc/passwd, SSH private keys, or Terraform credentials).
3. Trigger go-getter processing: Supply the malicious URL to the vulnerable application — for example, as a Terraform module source in a terraform init command, or directly via a go-getter API call — causing the library to process the URL and invoke the vulnerable git code path.
4. Capture file contents: The arbitrary file read causes the targeted file's contents to be included in the git operation output or error messages, which the attacker captures (e.g., via error output from terraform init or a controlled git server receiving the data).
5. Exfiltrate and leverage: Use the disclosed file contents (credentials, keys, configuration) for further access, lateral movement, or privilege escalation within the target environment (PoC Repository, HashiCorp Advisory).

• Network: Outbound git or HTTP connections from application servers to unexpected or unknown external git repositories, especially during terraform init or similar operations; unusual DNS lookups for attacker-controlled domains during go-getter invocations.
• Logs: Application or Terraform logs showing git clone/fetch operations against unexpected URLs; error messages containing file contents or path traversal artifacts; go-getter error output referencing local file paths unexpectedly.
• Process: Unexpected git subprocess invocations spawned by Terraform, Infracost, or other go-getter-dependent processes with unusual URL arguments; git processes accessing sensitive directories (e.g., ~/.ssh/, /etc/, credential stores).
• File System: Unexpected access timestamps on sensitive files (e.g., /etc/passwd, SSH keys, .terraform credential files) correlating with go-getter or Terraform execution times (PoC Repository).

The primary remediation is to upgrade HashiCorp go-getter to v1.8.6 or later, which contains the fix for this vulnerability (GitHub Advisory, HashiCorp Advisory). Organizations using go-getter/v2 are not affected and do not need to take action. As a workaround where immediate upgrade is not possible, restrict the URLs that can be passed to go-getter to trusted, allowlisted sources, and avoid processing URLs from untrusted or user-controlled input. Downstream tools such as Terraform and Infracost that embed go-getter v1 should also be updated to versions that incorporate the patched library.

HashiCorp published an official security advisory (HCSEC-2026-04) disclosing the vulnerability and confirming the fix in go-getter v1.8.6 (HashiCorp Advisory). The Infracost project responded by opening pull requests to update their go-getter dependency (Infracost PR). Snyk also announced CLI updates incorporating the fix. Community discussion on Mastodon and Bluesky noted the vulnerability shortly after disclosure, and security aggregators including Tenable (Nessus plugin 305826) and Qualys rapidly added detection coverage.