HCSEC-2026-31 - Go-slug vulnerable to exclusion bypass in .terraformignore handling

Bulletin ID: HCSEC-2026-31 Affected Products / Versions: github.com/hashicorp/go-slug v0.4.0 through v0.18.2; fixed in v0.18.3. Publication Date: August 20, 2026 Summary The github.com/hashicorp/go-slug library before v0.18.3 is vulnerable to an exclusion bypass in .terraformignore handling that may allow files intended to be excluded from Terraform Cloud or Terraform Enterprise working directory uploads to be included instead on affected macOS filesystems. This issue requires a local working directory whose filenames and ignore patterns differ only by Unicode normalization, and is most relevant when operators rely on .terraformignore to keep sensitive local files out of remote runs. This vulnerability (CVE-2026-14978) is fixed in github.com/hashicorp/go-slug v0.18.3. Background The github.com/hashicorp/go-slug library builds archive bundles from a local working directory for downstream consumers, including Terraform CLI workflows that upload configuration content to Terraform Cloud or Terraform Enterprise. .terraformignore allows operators to exclude local files and directories from those uploads so that unnecessary or sensitive content is not included in remote runs. Details In affected versions, .terraformignore matching may not consistently treat canonically equivalent Unicode filenames as the same path on affected macOS filesystems. As a result, a file whose displayed name appears to match an exclusion rule could still be included in the generated upload bundle when the on-disk filename and the ignore rule use different Unicode normalization forms. This issue requires local control over the working directory contents and applies to scenarios where operators use non-ASCII filenames in combination with .terraformignore. Configurations that do not rely on .terraformignore, use only ASCII filenames and patterns, or run on filesystems that do not present this normalization behavior are not affected. Remediation Customers should evaluate the risk associated with this…