GO-2026-6497 vulnerabilities

Vulnerabilities for packages: maru, opentofu, helm-mapkubeapis, cluster-api-helm-controller, kube-arangodb, rancher-helm, manifest-tool, k8sgpt, xeol, kargo, k9s, cert-manager-cmctl, gitness, helm-push, helm-set-status, kyverno-notation-aws, tigera-operator, flux-helm-controller...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: maru, opentofu, helm-mapkubeapis, cluster-api-helm-controller, kube-arangodb, rancher-helm, manifest-tool, k8sgpt, xeol, kargo, k9s, cert-manager-cmctl, gitness, helm-push, helm-set-status, kyverno-notation-aws, tigera-operator, flux-helm-controller...

GO-2026-6508 vulnerabilities

Vulnerabilities for packages: fluent-bit-plugin-loki, caddy, tempo, opentofu, falcosidekick, mcp-grafana, zot, harbor-registry, loki, amazon-cloudwatch-agent, datadog-agent, grafana, kots, grafana-pyroscope, aws-otel-collector, distribution, grafana-alloy, grafana-mimir, pulumi-kubernetes-operato...

CVE-2026-81871 vulnerabilities

Vulnerabilities for packages: google-cloud-otel-ops-collector, kots, grafana-alloy-fips, percona-grafana, caddy-fips, grafana-geomys-fips, amazon-cloudwatch-agent, opentelemetry-go-instrumentation-fips, distribution-fips, datadog-agent, frankenphp-8.2, grafana-pyroscope-fips,...

CLEANSTART-2026-LK31103 Security fix for CVE-2025-52894 applied in: opentofu-fips 1.10.7-r1, opentofu-fips 1.10.7-r2

CVE-2025-52894 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-TK35937 Security fix for CVE-2024-10006 applied in: opentofu-fips 1.10.9-r0, opentofu-fips 1.7.10-r1, opentofu-fips 1.8.11-r1, rundeck 6.0.0-r0

CVE-2024-10006 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AW78522 Security fix for CVE-2024-10005 applied in: opentofu-fips 1.10.9-r0, opentofu-fips 1.7.10-r1, opentofu-fips 1.8.11-r1, rundeck 6.0.0-r0

CVE-2024-10005 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

GHSA-92X3-5H48-MFHX vulnerabilities

Vulnerabilities for packages: opentofu, terraform-mcp-server, terraform...

CVE-2026-14978 vulnerabilities

Vulnerabilities for packages: opentofu, terraform-mcp-server, terraform...

CVE-2026-14978 vulnerabilities

Vulnerabilities for packages: helmfile, terraform-fips, vault, terraform, vault-fips, terraform-ls, terraform-mcp-server, opentofu-fips, opentofu...

GHSA-92X3-5H48-MFHX vulnerabilities

Vulnerabilities for packages: helmfile, terraform-fips, vault, terraform, vault-fips, terraform-ls, terraform-mcp-server, opentofu-fips, opentofu...

GHSA-22W5-2FXG-VRWX OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers

Impact Unauthenticated denial of service. Summary When OpenTofu performs requests against an untrusted or compromised third-party server or connects to an attacker-controlled server, the initial connection negotiation can produce high CPU usage, leading to possible denial of service. These...

OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers

Impact Unauthenticated denial of service. Summary When OpenTofu performs requests against an untrusted or compromised third-party server or connects to an attacker-controlled server, the initial connection negotiation can produce high CPU usage, leading to possible denial of service. These...

CVE-2026-74797

A flaw was found in OpenTofu. A remote attacker could exploit this vulnerability by providing maliciously-crafted .zip archives during the tofu init command, which is used for provider or module package initialization. This could lead to excessive CPU usage, causing a Denial of Service DoS by...

CVE-2024-58375

A flaw was found in OpenTofu. When users enable static evaluation of module sources, versions, and backend configurations, the software does not properly restrict sensitive variables and locals. This oversight can lead to the exposure of values intended to be sensitive through these configuration...

CVE-2026-74796

A flaw was found in OpenTofu. This vulnerability allows attackers to exploit a symlink following path traversal during the initialization process. By placing a malicious symbolic link in a trusted working directory, an attacker can cause the 'tofu init' command to write provider package contents ...

CVE-2026-74797

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation,...

CVE-2026-74796

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...

CVE-2024-58375

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead o...

CVE-2026-74797

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation,...