---
id: CVE-2024-58375
title: >-
  OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive
  variables and locals when users have opted into static evaluation of module
  sources, versions, and backend configurations
summary: >-
  OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive
  variables and locals when users have opted into static evaluation of module
  sources, versions, and backend configurations. As a result, values marked as
  sensitive m…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-497
vendor: opentofu
product: github.com/opentofu/opentofu
affected:
  - 'github.com/opentofu/opentofu >= 1.8.0, < 1.8.3'
patched:
  - github.com/opentofu/opentofu 1.8.3
published: '2026-08-16'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:28:37.587'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-58375'
references:
  - url: >-
      https://github.com/opentofu/opentofu/security/advisories/GHSA-wpr2-j6gr-pjw9
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/opentofu-before-secret-variable-leaking-via-static-evaluation
    label: disclosure@vulncheck.com
  - url: 'https://github.com/opentofu/opentofu'
  - url: 'https://pkg.go.dev/vuln/GO-2024-3182'
tags:
  - nvd
  - osv
  - go
  - score-dispute
epss: 0.00255
epssPercentile: 0.17328
aliases:
  - GHSA-wpr2-j6gr-pjw9
  - GO-2024-3182
ecosystem: go
scores:
  nvd: 7.5
  osv: 3.7
ingestedAt: '2026-08-17T19:20:56.119Z'
---

## Overview

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead of producing an error. This is fixed in OpenTofu 1.8.3, which adds explicit errors to prevent the use of sensitive values in these contexts.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2024-58375)

Affected packages:

- `github.com/opentofu/opentofu >= 1.8.0, < 1.8.3`

Patched in:

- `github.com/opentofu/opentofu 1.8.3`

Source: https://osv.dev/vulnerability/GHSA-wpr2-j6gr-pjw9