CVE-2026-104994
LOW
CVSS 2.5
Published: 2026-10-02
Modified: 2026-10-02
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input (e.g., upon a third-party pull request that contains a Terraform configuration), if sensitive data can be found at those unintended pathnames, and an adversary can then view a sensitive data value within scan output.
Quick Facts
| CVE ID | CVE-2026-104994 |
| CVSS Score | 2.5 |
| Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
| Published | 2026-10-02 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |