{"id":"CVE-2026-74796","title":"OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization","summary":"OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package content…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N","cwe":["CWE-59"],"vendor":"opentofu","product":"github.com/opentofu/opentofu","affected":["github.com/opentofu/opentofu >= 1.11.0, < 1.11.7","github.com/opentofu/opentofu < 1.10.10"],"patched":["github.com/opentofu/opentofu 1.11.7","github.com/opentofu/opentofu 1.10.10"],"published":"2026-08-16","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:28:37.587","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74796","references":[{"url":"https://github.com/opentofu/opentofu/security/advisories/GHSA-wcmj-x466-56mm","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/opentofu-before-symlink-following-path-traversal","label":"disclosure@vulncheck.com"},{"url":"https://github.com/opentofu/opentofu"}],"tags":["nvd","osv","go"],"epss":0.00229,"epssPercentile":0.13951,"aliases":["GHSA-wcmj-x466-56mm","GO-2026-5705"],"ecosystem":"go","ingestedAt":"2026-08-17T19:20:56.083Z","slug":"CVE-2026-74796","body":"## Overview\n\nOpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-74796)\n\nAffected packages:\n\n- `github.com/opentofu/opentofu >= 1.11.0, < 1.11.7`\n- `github.com/opentofu/opentofu < 1.10.10`\n\nPatched in:\n\n- `github.com/opentofu/opentofu 1.11.7`\n- `github.com/opentofu/opentofu 1.10.10`\n\nSource: https://osv.dev/vulnerability/GHSA-wcmj-x466-56mm","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}