Infrastructure
Terraform: supported versions, open vulnerabilities and status today
Terraform 1.16 and 1.15 are supported; 1.14 reached end of life on Aug 26, 2026; the latest release is 1.16.6. No advisories for Terraform were published in the last 12 months; none of its advisories is on CISA’s list of exploited vulnerabilities. Terraform Status shows no open incidents right now.
Last checked against endoflife.date, OSV.dev, CISA KEV, Terraform Status and deps.dev.
- Latest release
- 1.16.6
- GitHub stars
- 49.9k
- OpenSSF Scorecard
- 6.6 / 10
Supported versions
Security advisories
No advisories published in the last 12 months. 2 in total since records began. Checked packages: github.com/hashicorp/terraform.
Status now
No open incidents or maintenance right now.
16 incidents in the last 90 days (9 major). Most recent major: “Terraform Runs Failing” (2026-10-13). Consider retries, timeouts and a fallback path for this dependency. Not counted: 3 notices marked no impact.
Licence
Terraform is source-available (BUSL 1.1) since 1.6
HashiCorp moved from MPL 2.0 to the Business Source License 1.1 in August 2023. Running it for your own infrastructure is allowed; offering a competing hosted or embedded product is not.
Maintenance and supply chain
OpenSSF Scorecard 6.6 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 8 issue updates found in the last 90 days.
Weakest checks
- Over-privileged CI tokens (Token-Permissions 0/10)
- No static analysis (SAST 0/10)
- No fuzzing (Fuzzing 0/10)
Production checklist
Terraform production checklist: 5 checks before launch
- Should do: Use remote state with locking and encryption
- Should do: Treat state as a secret
- Should do: Review the plan in CI before every apply
Docs and release notes
Check Terraform in your own stack
This page checks Terraform in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.