Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: opentofu Clear all filters
TI-2026-52561 CVE-2026-74797 · GHSA-3vh9-9frp-jhqv

OpenTofu before 1.11.4 Denial of Service via malicious zip

Priority LOW 12

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00283 Published 2026-08-16 Fixed in 1.11.4 CWE-400
TI-2026-52560 CVE-2026-74796 · GHSA-69hj-5jh6-6q99

OpenTofu before 1.11.7 Symlink Following Path Traversal

Priority LOW 31

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization.

CVSS 4.0HIGH 7.0 Network No auth User interaction EPSS 0.00339 Published 2026-08-16 Fixed in 1.11.7 CWE-59
TI-2024-38456 CVE-2024-58375 · GHSA-p8hv-x2cr-398f

OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation

Priority MEDIUM 44

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00432 Published 2026-08-16 Fixed in 1.8.3 CWE-497