HashiCorp go-slug: Unicode normalization mismatch lets excluded files slip past .terraformignore into the upload

Impact

go-slug is the library Terraform uses to pack a configuration directory into the slug it uploads to a run backend, and .terraformignore is what keeps things out of that package. Because path matching normalizes Unicode inconsistently, a filename can look excluded and still be bundled. What ends up shipped is whatever you deliberately excluded from the directory: tfvars holding cloud credentials, state backups, provisioning keys for the GPU nodes the config builds. Once uploaded, that material is readable by anyone with access to the run environment or the workspace, which is a wider audience than the people who can read the repo. Affected range is 0.4.0 through 0.18.2, scored 5.5, local and confidentiality-only.

Who can reach it

A local user or repository contributor who can control filenames inside the Terraform configuration directory before a plan or apply packs it. No remote path and no elevated privileges; the only requirement is getting a file into the tree that the packer walks.

What to do

Move off the affected go-slug range and rebuild or update whatever vendors it, which in practice means the Terraform CLI or the vendor product embedding it; IBM support node 7286070 covers the products IBM ships it in. The record gives the affected range but no fixed version, so take that from the upstream release rather than assuming. There is no daemon to restart and no node to touch, this is a tooling and CI image update. Independent of the patch, stop treating .terraformignore as a security boundary: keep secrets out of the configuration directory rather than relying on an exclusion rule, and rotate anything you find in a past upload.

References

Related entries

• IBM Storage Scale management GUI (deploy and upgrade logging): The Storage Scale admin password is written in the clearCVE-2026-19483 · IBM Storage Scale management GUI (deploy and upgrade logging)Medium
• Linux perf/x86 - event pointer setup ordering in x86_pmu_enable(): A NULL pointer dereference in the x86 PMU enableCVE-2026-23435 · Linux perf/x86 - event pointer setup ordering in x86_pmu_enable()Medium
• GitLab EE: project Maintainer can open a terminal on a protected environment they are not authorized forCVE-2026-3035 · GitLab EE (protected environment terminal authorization)Medium
• Linux EDAC/mc - error path ordering in edac_mc_alloc(): When a private-data allocation fails in edac_mc_alloc()CVE-2026-31689 · Linux EDAC/mc - error path ordering in edac_mc_alloc()Medium
• Linux iommu/vt-d (dev-IOTLB flush in scalable mode): The scalable-mode half of the device-IOTLB invalidation problem —CVE-2026-43130 · Linux iommu/vt-d (dev-IOTLB flush in scalable mode)Medium
• Linux iommu/vt-d (dev-IOTLB flush for passed-through PCIe devices): The Intel IOMMU driver skips device-IOTLBCVE-2026-43161 · Linux iommu/vt-d (dev-IOTLB flush for passed-through PCIe devices)Medium