PT-2026-73163

Name of the Vulnerable Software and Affected Versions OpenTofu versions prior to 1.11.7 Description During initialization, the software fails to validate existing symlinks within the provider cache directory. This allows an attacker to place a malicious symlink in a trusted working directory,...

GHSA-Q7J3-V8QV-22VQ OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL

Impact Possible data exposure. Summary While downloading packages from a maliciously crafted URL, some git operations against that URL could allow arbitrary file read. This might allow disclosure of confidential information. Details OpenTofu relies on go-getter for downloading packages like...

GHSA-PXH5-6RRC-8RJV vulnerabilities

Vulnerabilities for packages: opentofu...

GHSA-PXH5-6RRC-8RJV vulnerabilities

Vulnerabilities for packages: opentofu-fips, opentofu...

OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server

Impact Unauthenticated denial of service. Summary When installing provider or module packages from attacker-controlled servers, the server may cause tofu initto enter an infinite loop sending garbage data to that server. Those who depend on modules or providers served from untrusted third-party...

GHSA-PXH5-6RRC-8RJV OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server

Impact Unauthenticated denial of service. Summary When installing provider or module packages from attacker-controlled servers, the server may cause tofu initto enter an infinite loop sending garbage data to that server. Those who depend on modules or providers served from untrusted third-party...

CLEANSTART-2026-CN84623 Within HostnameError

Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-GY48351 Within HostnameError

Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-XN15507 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

Multiple security vulnerabilities affect the opentofu-fips package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details...

CLEANSTART-2026-MI12470 Within HostnameError

Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-SO13464 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

Multiple security vulnerabilities affect the opentofu-fips package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, sftpgo-plugin-auth, yunikorn-k8shim, spqr, xeol, openbao, flux, telegraf, cert-manager, gitea, k6, flux-source-controller, harbor, teleport, kyverno, external-secrets-operator, percona-server-mongodb-operator, cert-manager-istio-csr, bento,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, sftpgo-plugin-auth, yunikorn-k8shim, spqr, xeol, openbao, flux, telegraf, cert-manager, gitea, k6, flux-source-controller, harbor, teleport, kyverno, external-secrets-operator, percona-server-mongodb-operator, cert-manager-istio-csr, bento,...

OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses

Impact Unauthenticated denial of service. Summary When installing module packages from attacker-controlled sources, tofu init may use unbounded memory, cause high CPU usage, or deadlock when encountering maliciously-crafted TLS certificate chains or tar archives. Those who depend on modules or...

GHSA-92MM-2PJQ-R785 vulnerabilities

Vulnerabilities for packages: steampipe, kots, xeol, trivy-operator, trivy, wolfictl, k9s, syft, tfsec, terragrunt, conftest, terraform, snyk-cli, zot, zarf, tflint, kubescape, task, grype, opentofu...

CVE-2026-4660 vulnerabilities

Vulnerabilities for packages: steampipe, kots, xeol, trivy-operator, trivy, wolfictl, k9s, syft, tfsec, terragrunt, conftest, terraform, snyk-cli, zot, zarf, tflint, kubescape, task, grype, opentofu...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: opa-envoy, tkn, kots, spqr, crossplane-provider-sql, kubernetes, mattermost, net-kourier, dkron, sriov-network-device-plugin, terraform-provider-tls, kubernetes-dashboard-api, ingress-nginx-controller, runc, terraform-provider-azuread, dask-gateway, gitaly,...

GHSA-W8RR-5GCM-PP58 vulnerabilities

Vulnerabilities for packages: grafana-alloy, fleet-server, jaeger-fips, terraform, kiali-fips, opa-fips-envoy, beats, knative-operator-fips, caddy, headlamp-fips, knative-net-istio-fips, harbor-registry, k6-operator-fips, gitlab-kas, docker, authentik-fips, grafana-image-renderer, gitaly-fips,...

CVE-2026-39882 vulnerabilities

Vulnerabilities for packages: grafana-alloy, fleet-server, jaeger-fips, terraform, kiali-fips, opa-fips-envoy, beats, knative-operator-fips, caddy, headlamp-fips, knative-net-istio-fips, harbor-registry, k6-operator-fips, gitlab-kas, docker, authentik-fips, grafana-image-renderer, gitaly-fips,...

CLEANSTART-2026-AD71344 Security fixes for CVE-2024-10005, CVE-2024-10006, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181, CVE-2025-61727, CVE-2025-61729, CVE-2026-1229, CVE-2026-24051, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, ghsa-2464-8j7c-4cjm, ghsa-2x5j-vhc8-9cwm, ghsa-6v2p-p543-phr9, ghsa-c6gw-w398-hv78, ghsa-fv92-fjc5-jj9h, ghsa-hcg3-q754-cr77, ghsa-jc7w-c686-c4v9, ghsa-mh63-6h87-95cp, ghsa-p77j-4mvh-x3m3, ghsa-qxp5-gwg8-xv66, ghsa-vvgc-356p-c3xw, ghsa-wjrx-6529-hcj3 applied in versions: 1.10.7-r0, 1.10.7-r1, 1.10.9-r0, 1.10.9-r1, 1.10.9-r2, 1.10.9-r3, 1.9.4-r0

Multiple security vulnerabilities affect the opentofu-fips package. These issues are resolved in later releases. See references for individual vulnerability details...