Terraform: security advisories, deprecations and releases

Terraform now built with Go 1.26.10

Terraform 1.17.0 is compiled with Go 1.26.10, removing trust for certificates issued by compromised eMudhra intermediate CAs (CVE-2026-111943).

CVE-2026-111943

Also covered by Terraform releases

Graphalgo malware found in Terraform providers and Go modules

Malicious Terraform providers and Go modules drop a Go RAT activated only when two variable hashes match attacker-controlled values.

Terraform 1.17 released

Terraform 1.17 was released on 2026-10-21.

Terraform v1.17.1 released

Bug fixes for fmt file preservation, module policy evaluation during destroy plans, and stacks policy reporting for replaced resources.

Terraform v1.16.6 released

Bug fixes for cloud workspace tag lookup and test modules, plus mitigation for a low-risk HTTP/2 exhaustion CVE.

CVE-2026-78669

Terraform v1.16.5 released

Terraform 1.16.5 fixes a crash when tainted instance state lacks a valid status and a nil resource-identity issue during delete operations.

Terraform v1.16.4 bug fixes

Patch release fixes policy rendering for older Terraform Enterprise and deferred error handling with count/for_each.

Terraform 1.16 completes Actions lifecycles and brings imports into child modules

Terraform 1.16 adds before_destroy/after_destroy Actions for resource teardown and allows import blocks inside child modules.