CVE-2026-104994

Severity: low (CVSS 2.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-02 · updated 2026-10-05
Weakness: CWE-24

Description

Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input (e.g., upon a third-party pull request that contains a Terraform configuration), if sensitive data can be found at those unintended pathnames, and an adversary can then view a sensitive data value within scan output.

Affected products

aquasecurity trivy: before 0.71.0 — fixed in 0.71.0

How to fix

Upgrade to a fixed version: aquasecurity trivy 0.71.0. Check the vendor advisory for mitigations.

References

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md
https://github.com/aquasecurity/trivy/commit/9d91b888cf63023e9c09b64259a4c1cea8dfe993
https://github.com/aquasecurity/trivy/pull/10664
https://github.com/aquasecurity/trivy/security/advisories/GHSA-87hp-4m93-274g

Get alerted when CVE-2026-104994 or the next vulnerability affects your stack