Database/Control plane, storage & DevOps

Terraform Enterprise: users without write access can create state versions and steer later applies

CVSS 4.3CVE-2025-13432Control plane, storage & DevOpscurated

Impact

Terraform Enterprise is the change control point for a lot of GPU fleet infrastructure - node pools, network, IAM. A user holding some workspace permissions but not write access can create a state version, and if a subsequent plan is auto-applied or approved by someone with apply rights, that injected state alters real infrastructure. The practical risk is an approver rubber-stamping a plan derived from state they did not expect, so the integrity failure lands on infrastructure rather than on the Terraform app itself. Confidentiality and availability are unaffected.

Who can reach it

Authenticated Terraform Enterprise user with partial workspace permissions but no write access; exploitation also needs an approved or auto-applied run to follow.

What to do

Upgrade Terraform Enterprise to 1.1.1 or 1.0.3. Standard TFE application upgrade and restart; no node work. Until patched, review auto-apply on workspaces that manage fleet-level resources and audit recent state versions on sensitive workspaces.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-13432 https://discuss.hashicorp.com/t/hcsec-2025-34-terraform-enterprise-state-versions-can-be-created-by-users-without-sufficient-write-access/76821

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.