What’s Vulnerable › Vulnerabilities
CVE-2025-13432: Terraform Enterprise state versions can be created by users with specific permissions without sufficient write access
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-11-21 · updated 2026-10-08
- Weakness: CWE-863
Description
Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied. This vulnerability, CVE-2025-13432, is fixed in Terraform Enterprise version 1.1.1 and 1.0.3.
Affected products
- HashiCorp Terraform: from 1.0.0 before 1.0.3; 1.1.0 — fixed in 1.0.3
How to fix
Upgrade to a fixed version: HashiCorp Terraform 1.0.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-13432 or the next vulnerability affects your stack