Read the docs
TI-2024-39047 Aliases GHSA-wpr2-j6gr-pjw9

OpenTofu potential leaking of secret variable values when using static evaluation in v1.8

Priority LOW 38CWE-200Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Information disclosure
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-200.

Summary

### Impact Users who have opted into static evaluation of module sources, versions, and backend configurations may be at risk of exposing sensitive variables and locals. This is a workflow that should not be possible and explicitly show errors. ### Workarounds Check that you are not using sensitive variables in module sources and versions, as well as backend configurations. The patch will add explicit errors and prevent this from being possible. ### Examples ```hcl variable "backend_path" { type = string sensitive = true } terraform { backend "local" { path = var.backend_path } } ``` ```hcl variable "mod_info" { type = string sensitive = true } module "foo" { source = var.mod_info //version = var.mod_info } ```

Why it matters now

Fix Fixed github.com/opentofu/opentofu (Go): 1.8.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—github.com/opentofu/opentofu (Go)1.8.0 to before 1.8.31.8.3Patch availableGHSA-wpr2-j6gr-pjw9
  • github.com/opentofu/opentofu (Go) Vendor— Affected 1.8.0 to before 1.8.3 Fixed in 1.8.3 Patch available GHSA-wpr2-j6gr-pjw9

Remediation

  • Fix · GHSA-wpr2-j6gr-pjw9 github.com/opentofu/opentofu (Go) Fixed in 1.8.3 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-wpr2-j6gr-pjw9

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences