Read the docs
TI-2026-52560 Aliases CVE-2026-74796GHSA-69hj-5jh6-6q99

OpenTofu before 1.11.7 Symlink Following Path Traversal

Priority LOW 31CWE-59Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00339 27th percentileScored 2026-11-07
Fix Fixed opentofu (opentofu): 1.11.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
opentofuopentofubefore 1.11.71.11.7Patch availableCNA
  • opentofu Vendoropentofu Affected before 1.11.7 Fixed in 1.11.7 Patch available CNA

Remediation

  • Fix · CNA opentofu (opentofu) Fixed in 1.11.7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-74796
  2. 2026-10-03 Alias added: GHSA-69hj-5jh6-6q99

References

Advisory 1

  • TI-2024-38456 OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation CVSS 4.0HIGH 8.7
  • TI-2026-52561 OpenTofu before 1.11.4 Denial of Service via malicious zip CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences