OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-497.
Summary
OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead of producing an error. This is fixed in OpenTofu 1.8.3, which adds explicit errors to prevent the use of sensitive values in these contexts.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA opentofu (opentofu) Fixed in 1.8.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-02 Threatist record created from CVE-2024-58375
- 2026-10-03 Alias added: GHSA-p8hv-x2cr-398f
References
More opentofu vulnerabilities
- TI-2026-52560 OpenTofu before 1.11.7 Symlink Following Path Traversal CVSS 4.0HIGH 7.0
- TI-2026-52561 OpenTofu before 1.11.4 Denial of Service via malicious zip CVSS 4.0LOW 2.3
Sources
- CVE-2024-58375 · CVE Program
- CVE-2024-58375 · NVD
- FIRST EPSS
- GHSA-p8hv-x2cr-398f · GitHub Advisory Database · CC BY 4.0
- CVE-2024-58375 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences