{"id":"CVE-2023-3114","aliases":["EUVD-2023-43800","GHSA-fhmj-jv7w-vvg2"],"status":"published","title":"Terraform Enterprise Agent Pool Controls Allowed Unauthorized Workspaces To Target an Agent Pool","description":"Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the same organization that targeted an agent pool. This vulnerability, CVE-2023-3114, is fixed in Terraform Enterprise v202306-1.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0042,"percentile":0.36563,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-266","CWE-863"],"published":"2023-06-22T21:59:46Z","modified":"2026-06-17T06:13:23Z","products":[{"vendor":"hashicorp","product":"terraform enterprise"},{"vendor":"hashicorp","product":"terraform_enterprise"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2023-18-terraform-enterprise-agent-pool-controls-allowed-unauthorized-workspaces-to-target-an-agent-pool/55329","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3114"},{"url":"https://github.com/advisories/GHSA-fhmj-jv7w-vvg2"}],"sources":{"cve":[{"id":"CVE-2023-3114","title":"Terraform Enterprise Agent Pool Controls Allowed Unauthorized Workspaces To Target an Agent Pool","description":"Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the same organization that targeted an agent pool. This vulnerability, CVE-2023-3114, is fixed in Terraform Enterprise v202306-1.","status":"published","published":"2023-06-22T21:59:46.778Z","modified":"2024-12-04T21:33:25.906Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:35:24.360381Z"}],"euvd":[{"id":"EUVD-2023-43800","description":"Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the same organization that targeted an agent pool. This vulnerability, CVE-2023-3114, is fixed in Terraform Enterprise v202306-1.","status":"published","published":"2023-06-22T21:59:46Z","modified":"2024-12-04T21:33:25Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:40.496649Z"}],"ghsa":[{"id":"GHSA-fhmj-jv7w-vvg2","title":"Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent...","description":"Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the same organization that targeted an agent pool. This vulnerability, CVE-2023-3114, is fixed in Terraform Enterprise v202306-1.","status":"published","published":"2023-06-23T00:30:20Z","modified":"2023-11-07T05:01:25Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:54:52.694731Z"}],"nvd":[{"id":"CVE-2023-3114","description":"Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the same organization that targeted an agent pool. This vulnerability, CVE-2023-3114, is fixed in Terraform Enterprise v202306-1.","status":"published","published":"2023-06-22T22:15:09.197Z","modified":"2026-06-17T06:13:23.357Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-266","CWE-863"],"updated_at":"2026-11-02T14:08:12.414559Z"}]}}