Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: opentofu1.12: opentofu1.12-1.12.7-0.2.hum1 aarch64, s390x, x8664 opentofu1.12-1.12.7-0.2.hum1.src src...

CLEANSTART-2026-SO98691 Security fix for GHSA-r92c-9c7f-3pj8 applied in: opentofu 1.11.4-r0

Security vulnerability affects the opentofu package. This issue is resolved in later releases. See references for vulnerability details...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: opentofu, manifest-tool, k8sgpt, cert-manager-cmctl, k9s, rancher-helm, helm-mapkubeapis, helm-set-status, cluster-api-helm-controller, flux-helm-controller, gitness, kargo, kyverno-notation-aws, kube-arangodb, helm-push, tigera-operator, xeol, maru...

GO-2026-6497 vulnerabilities

Vulnerabilities for packages: opentofu, manifest-tool, k8sgpt, cert-manager-cmctl, k9s, rancher-helm, helm-mapkubeapis, helm-set-status, cluster-api-helm-controller, flux-helm-controller, gitness, kargo, kyverno-notation-aws, kube-arangodb, helm-push, tigera-operator, xeol, maru...

GO-2026-6508 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope, amazon-cloudwatch-agent, grafana, pulumi-kubernetes-operator, mcp-grafana, datadog-agent, kots, traefik, caddy, aws-otel-collector, opentofu, falcosidekick, harbor-registry, loki, fluent-bit-plugin-loki, zot, grafana-alloy, distribution, tempo,...

OpenTofu DoS

The vulnerability of the OpenTofu infrastructure management tool is related to the presence of vulnerabilities in the borrowed components. Exploiting these vulnerabilities can allow a malicious actor, operating remotely, to cause service failures...

CVE-2026-81871 vulnerabilities

Vulnerabilities for packages: falcosidekick, harbor-registry, percona-grafana, terraform-fips, elastic-agent, harbor-registry-fips, amazon-cloudwatch-agent-fips, envoy-ai-gateway-fips, grafana-pyroscope, grafana-alloy, frankenphp-8.3, elastic-agent-fips, frankenphp-8.4, terraform,...

CLEANSTART-2026-CV85257 Security fix for GHSA-jc7w-c686-c4v9 applied in: gptscript 0.6.0-r0, gptscript 0.7.1-r0, gptscript 0.8.5-r0, opentofu-fips 1.10.7-r0, opentofu-fips 1.10.7-r1

GHSA-jc7w-c686-c4v9 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BJ71317 Security fix for GHSA-wjrx-6529-hcj3 applied in: atlantis 0.37.1-r1, atlantis-fips 0.37.1-r0, opentofu-fips 1.10.7-r0, opentofu-fips 1.10.7-r1

GHSA-wjrx-6529-hcj3 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LK31103 Security fix for CVE-2025-52894 applied in: opentofu-fips 1.10.7-r1, opentofu-fips 1.10.7-r2

CVE-2025-52894 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MI15449 Security fix for GHSA-r92c-9c7f-3pj8 applied in: opentofu-fips 1.11.4-r0

Security vulnerability affects the opentofu-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-TK35937 Security fix for CVE-2024-10006 applied in: opentofu-fips 1.10.9-r0, opentofu-fips 1.7.10-r1, opentofu-fips 1.8.11-r1, rundeck 6.0.0-r0

CVE-2024-10006 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AW78522 Security fix for CVE-2024-10005 applied in: opentofu-fips 1.10.9-r0, opentofu-fips 1.7.10-r1, opentofu-fips 1.8.11-r1, rundeck 6.0.0-r0

CVE-2024-10005 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

PT-2026-101120

Security vulnerability affects the opentofu-fips package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-14978 vulnerabilities

Vulnerabilities for packages: terraform, opentofu, terraform-mcp-server...

GHSA-92X3-5H48-MFHX vulnerabilities

Vulnerabilities for packages: terraform, opentofu, terraform-mcp-server...

CVE-2026-14978 vulnerabilities

Vulnerabilities for packages: terraform-ls, helmfile, terraform-fips, terraform-mcp-server, opentofu, opentofu-fips, vault-fips, terraform, vault...

GHSA-92X3-5H48-MFHX vulnerabilities

Vulnerabilities for packages: terraform-ls, helmfile, terraform-fips, terraform-mcp-server, opentofu, opentofu-fips, vault-fips, terraform, vault...

ROS-20260902-73-0014

The vulnerability in opentofu relates to the use of a name with an incorrect reference. Exploiting this vulnerability can allow a hacker to cause a service failure...

GO-2026-6262 OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers in github.com/opentofu/opentofu

OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers in github.com/opentofu/opentofu...