CVE-2023-3114: Terraform Enterprise Agent Pool Controls Allowed Unauthorized Workspaces To Target an Agent Pool

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-22 · updated 2026-06-17
Weakness: CWE-266

Description

Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the same organization that targeted an agent pool. This vulnerability, CVE-2023-3114, is fixed in Terraform Enterprise v202306-1.

Affected products

HashiCorp Terraform Enterprise: from 202207-1 before 202306-1 — fixed in 202306-1

How to fix

Upgrade to a fixed version: HashiCorp Terraform Enterprise 202306-1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-3114 or the next vulnerability affects your stack