CVE-2026-64672: 
MinimOS vulnerability analysis and mitigation

CVE-2026-64672 is a symlink-following vulnerability in Gruntwork Terragrunt's terragrunt catalog command, classified as "Terragrunt catalog predictable temp symlink clobber." The vulnerability affects all versions of github.com/gruntwork-io/terragrunt prior to v1.1.1. It was discovered by researcher @br0x2, who responsibly disclosed it; the advisory was published on September 22, 2026, and added to the GitHub Advisory Database on October 15, 2026. The CVSS v4.0 base score is 4.4 (Medium) (GitHub Advisory, Gruntwork Advisory).

The root cause is a combination of insecure temporary file creation (CWE-377) and improper link resolution before file access (CWE-59). In affected versions, the terragrunt catalog command derived a clone path deterministically as <tmp>/catalog-<base64-sha1-of-repo-URL>, making it fully predictable to any local user who knew the repository URL being cataloged. Because Terragrunt did not validate whether the path was a symlink before operating on it, an attacker could pre-plant a symlink at that location pointing to an arbitrary directory; when the victim ran terragrunt catalog, Terragrunt would follow the symlink, delete the target directory, and re-clone the repository into the attacker-controlled path — all in the victim's security context. The fix in v1.1.1 replaces the deterministic path with a fresh randomized temporary directory per load (using os.MkdirTemp-style generation) and explicitly rejects clone roots that are symlinks before any cleanup or cloning occurs (GitHub Advisory, Fix Commit).

Successful exploitation allows a local attacker to cause Terragrunt to delete an arbitrary directory outside the intended temporary root and overwrite it with cloned repository contents, impacting both integrity and availability of the targeted filesystem path. The attacker controls the parent directory the symlink points to, but the leaf name is fixed (derived from the repository URL), limiting but not eliminating the destructive potential. Confidentiality is not directly impacted, as the attack does not expose sensitive data. The primary risk is on multi-user systems or shared CI runners where multiple users share the system temporary directory (GitHub Advisory, Gruntwork Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The attack is strictly local — it requires the attacker to have write access to the shared system temporary directory and the victim to run terragrunt catalog while the symlink is in place. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry is currently associated with this vulnerability. The limited attack surface (local-only, requires specific timing and conditions) significantly reduces real-world exploitability (GitHub Advisory).

1. Reconnaissance: Identify a target multi-user system or shared CI runner where Terragrunt is installed and users run terragrunt catalog. Determine which repository URL(s) the victim is likely to catalog.
2. Compute the predictable path: Calculate the clone path using the formula <system_tmp>/catalog-<base64(sha1(repoURL))>. Since the formula is deterministic and public, any local user can compute it given the repository URL.
3. Plant the symlink: As a local attacker with write access to the system temporary directory, create a symlink at the computed path pointing to a target directory you wish to destroy or overwrite (e.g., ln -s /path/to/victim/directory /tmp/catalog-<hash>).
4. Wait for victim execution: Wait for the victim user to run terragrunt catalog referencing the targeted repository URL.
5. Trigger the clobber: When the victim runs terragrunt catalog, Terragrunt follows the symlink, deletes the directory at the symlink's target, and re-clones the repository into that location — all in the victim's security context, potentially destroying important data or injecting repository content into an unintended path (GitHub Advisory, Gruntwork Advisory).

• File System: Presence of a symlink in the system temporary directory matching the pattern catalog-<base64-sha1-string> pointing outside the temp directory; unexpected deletion or overwriting of directories outside /tmp or the system temp root coinciding with terragrunt catalog execution.
• Logs: System audit logs (e.g., auditd) showing unlink/rmdir syscalls on directories outside the temp root initiated by the Terragrunt process; file system change logs showing unexpected directory removal followed by new git repository content appearing at that path.
• Process: Terragrunt process performing RemoveAll and subsequent git clone operations on paths outside the expected temporary directory tree.

Upgrade to Terragrunt v1.1.1 or later, which resolves the vulnerability by generating randomized (non-deterministic) temporary clone directories and explicitly rejecting symlinked clone roots before any cleanup or cloning (GitHub Advisory, Fix PR). As a temporary workaround for those unable to upgrade immediately, ensure that untrusted parties cannot control or write to the values of TMPDIR, TMP, or TEMP environment variables in environments where terragrunt catalog is run. On shared CI runners, consider isolating Terragrunt execution to single-user environments or containers where the temporary directory is not shared with other users or processes (Gruntwork Advisory).

The vulnerability was responsibly disclosed by researcher @br0x2 and the fix was developed by Gruntwork contributor denis256, with the patch merged on July 7, 2026 and the advisory published on September 22, 2026. No significant broader media coverage or notable community commentary beyond the GitHub advisory and pull request review has been identified (Gruntwork Advisory, Fix PR).