GHSA-q7j3-v8qv-22vqHigh· 7.5▾ TwilightOpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Possible data exposure.
While downloading packages from a maliciously crafted URL, some git operations against that URL could allow arbitrary file read. This might allow disclosure of confidential information.
OpenTofu relies on go-getter for downloading packages like providers and modules. While doing so from a maliciously crafted URL, the operator could be affected by confidential information disclosure.
The go-getter maintainers have recently published CVE-2026-4660 for this library which indirectly affects OpenTofu's behavior.
Typical use of OpenTofu already requires caution in selection of URLs that are used to download modules and providers.
OpenTofu v1.11.10 and v1.12.3 address these vulnerabilities by upgrading to the hashicorp/[email protected] that fixes this vulnerability.
The OpenTofu v1.10 series is also impacted by these vulnerabilities. However, that series is built with an older version of the library and upgrading it risks breaking the whole v1.10 series. For those using OpenTofu v1.10 releases, we recommend planning an upgrade to OpenTofu v1.11.10 in the near future.
github.com/opentofu/opentofu < 1.11.10github.com/opentofu/opentofu >= 1.12.0-beta1, < 1.12.3Upgrade to a patched release:
github.com/opentofu/opentofu 1.11.10github.com/opentofu/opentofu 1.12.3Connected by shared product, vendor, weakness, or advisory.
GO-2026-6262NoneOpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or c…
GHSA-22w5-2fxg-vrwxLow· 2.6OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or c…
CVE-2024-58375High· 7.5OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations
CVE-2026-74796Medium· 6.1OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization
CVE-2026-74797Low· 3.1OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages
GHSA-wcmj-x466-56mmMedium· 6.1OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree