mattrobinsonsre/terrapod v1.8.4

on GitHub

Terrapod is a free, open-source platform replacement for Terraform Enterprise.
This is a security patch for the v1.8 line.

Every deployment on this line should take it. Three of the four fixes are
reachable by anyone holding a listener certificate — which is every agent pool
in the deployment, not only the pool a run belongs to — and none of them depends
on a feature you have to have opted into.

Security

• A listener can no longer obtain a runner token for a run it does not own.
  The runner-token endpoint compared only the listener id in the request path,
  which the caller chooses, and never checked the caller's certificate. So a
  valid listener certificate from any agent pool could mint a runner token for
  any run — and a runner token is what authorises artifact, state and
  plan-result writes for that run. The five sibling listener endpoints already
  carried this check.
• A listener can no longer confirm a run. The status endpoint accepted any
  transition the state machine permitted, including planned → confirmed,
  which skips the apply capability check, the human confirmation, the staleness
  and plan-expiry guards and the mergeability gate. A listener may now report
  only the outcomes its own Job can have produced, keyed on the (from, to)
  pair rather than the target — because confirmed is the bypass when it comes
  from planned and a legitimate apply-phase unclaim when it comes from
  applying.
• A listener can only report on runs in its own agent pool. The job-status
  and live-log endpoints verified the certificate against the listener id in the
  path and then took the run from the path unchecked, so a certificate from any
  pool could report a Job's outcome for any run in the deployment — and the run
  reconciler reads that report back to decide whether a plan or an apply
  completed. The boundary is the pool rather than the owning listener, because
  listeners within a pool are interchangeable by design and any of them may
  answer a request the reconciler broadcast to the pool.
• Two HIGH Go standard-library CVEs — CVE-2026-78667 (net/http, denial of
  service via crafted Range headers) and CVE-2026-97031 (crypto/tls, denial of
  service via ECH outer extension references). Every Go module on this line is
  rebuilt on Go 1.26.9. That covers the provider, the migration and publish
  CLIs, the MCP server and the SDK as well as the binary baked into the images —
  image scanning only sees the last of those.

Status

Beta — a security patch to the v1.8 line. v1.8.4 supersedes v1.8.3 for every deployment on it. Note v1.8 is older than the previous minor, so it is outside the window SECURITY.md commits to; this release is offered because the fixes are small and the exposure is not.

Full Changelog: v1.8.3...v1.8.4