Read the docs

opentofu

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

opentofu records in CISA KEV

No opentofu vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2024-38456 CVE-2024-58375 · GHSA-p8hv-x2cr-398f

OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation

Priority MEDIUM 44

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00432 Published 2026-08-16 Fixed in 1.8.3 CWE-497
TI-2026-52560 CVE-2026-74796 · GHSA-69hj-5jh6-6q99

OpenTofu before 1.11.7 Symlink Following Path Traversal

Priority LOW 31

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization.

CVSS 4.0HIGH 7.0 Network No auth User interaction EPSS 0.00339 Published 2026-08-16 Fixed in 1.11.7 CWE-59
TI-2026-52561 CVE-2026-74797 · GHSA-3vh9-9frp-jhqv

OpenTofu before 1.11.4 Denial of Service via malicious zip

Priority LOW 12

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00283 Published 2026-08-16 Fixed in 1.11.4 CWE-400
Open these records in search →