Vulnerability Reporthashicorp/terraform:latest

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker who could supply a malicious compressed response to Terraform during a provider or module download might crash the process, corrupt memory, or potentially run code in the context of the root user. Note: CVE-2026-111497 only applies if a component in this image actually loads the brotli library to decode remote data, so confirm that path exists in your deployment before treating it as active. The image is otherwise from a verified publisher, but the exposed-surface finding and the default root runtime user warrant strict compensating controls, such as restricting outbound network destinations and running the container as a non-root user.