Terraform v1.15.9 - Validation Diagnostics And Ignore CVE

Terraform v1.15.9 was published on 19 August 2026. The tag bumps go-slug to v0.18.3 to mitigate CVE-2026-14978, a Unicode normalization bug that could skip .terraformignore exclusions when packing a slug for Terraform Enterprise or HCP Terraform. The same patch also restores child module validation diagnostics for invalid list, import, backend, and cloud blocks.

The full release notes and downloads are on the GitHub release page. This is a stable patch, not a prerelease.

terraform validate is the cheap gate most data platform CI jobs run before plan. It should fail closed on config that cannot be legal, including blocks that only belong at the root of a configuration.

Issue 38994 is the bug. Child module validation did not raise error or warning diagnostics for invalid list, import, backend, and cloud blocks. Those stanzas are root configuration. A reusable module is not a workspace. If a module author copied them into a shared module, validate could stay green while the graph was wrong.

v1.15.9 makes validate match the documented placement rules. After the upgrade, a child module that contains those blocks will emit errors or warning diagnostics. The release notes do not introduce new block types and do not change HCL syntax.

Operators who vendor warehouse, Kafka, object storage, or Kubernetes modules under a nested layout should rerun validate against the module directories, not only against the root stack. A root that never declared those blocks can still consume a child that did.

The cost is noisy CI. Configs that have been applying for months can start failing validate once the binary in the image moves to v1.15.9. That is the point of the fix. Treat a new diagnostic as a module bug, not as a Terraform regression, unless the block is actually legal in that position on 1.15.

The notes say “errors or warning diagnostics” without listing which of the four blocks is an error and which is a warning. Do not assume all four fail the process. Read the diagnostic severity in CI output before you rewrite a module.

The NOTES entry is a library bump with a CVE attached. Terraform updates go-slug to v0.18.3 to mitigate CVE-2026-14978. The tracker is issue 39036.

go-slug packs the working directory into the archive uploaded for a remote run on Terraform Enterprise or HCP Terraform. .terraformignore is the exclusion list for that archive. The CVE is a Unicode normalization issue. A path and an ignore pattern can look identical in a pager and still be different byte sequences. If matching does not normalize both sides, a file the ignore file was written to drop can still be packed and sent.

Blast radius is the remote upload path. Local terraform apply against a disk or local backend does not pack a slug. Workspaces that run on Terraform Enterprise or HCP Terraform do. Typical extras next to .tf files are local state copies, .env files, extracted dumps, vendor trees, and generated data.

The notes do not describe remote code execution. They describe files not being correctly excluded via .terraformignore from upload during a run. That is a data leak and a policy miss. It is not a change to plan or apply logic.

ASCII only ignore patterns against ASCII only names (*.tfstate, .env, data/) are the low risk case. The interesting trees are the ones with non ASCII filenames, macOS paths that store a different Unicode form than the ignore file, or patterns copied between machines.

The GitHub release page is the canonical note for the bump. There is no extra mitigation listed beyond shipping go-slug v0.18.3.

If a workspace already uploaded slugs under the old library, this patch does not rewind those archives. It only changes what later runs pack. Rotate anything that should never have left the runner if you have reason to believe ignore matching failed.

v1.15.9 is not a prerelease. There is no migration guide and no stated breaking change in the language.

Two behaviors still move:

  • Child module terraform validate can now fail or warn on list, import, backend, and cloud blocks that used to be silent. Run validate on module directories before rolling the binary through CI images.
  • Remote runs on Terraform Enterprise or HCP Terraform pack slugs with the patched go-slug. Recheck .terraformignore if the tree has non ASCII paths, or if ignore is what keeps secrets and bulk data out of the upload.

Pin CI images to the v1.15.9 binary rather than floating on the 1.15 series. Then run a representative set of nested modules through validate and confirm a remote run still excludes what the ignore file lists.