EUVD-2026-59961

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...

CVE-2026-74796

OpenTofu before 1.11.7 is affected by a symlink following path traversal during initialization. The vulnerability arises because OpenTofu fails to validate existing symlinks in the provider cache directory, allowing an attacker to place a malicious symlink in a trusted working directory and cause...

CVE-2024-58375 OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead o...

EUVD-2024-55722

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead o...

CVE-2024-58375

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead o...

CVE-2024-58375 OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead o...

CVE-2024-58375

OpenTofu 1.8.0–1.8.2 do not properly restrict sensitive variables/locals when static evaluation is enabled, allowing potential leakage of values marked as sensitive through configuration elements. The issue is resolved in OpenTofu 1.8.3, which adds explicit errors to prevent use of sensitive valu...

GO-2026-5558 vulnerabilities

Vulnerabilities for packages: opentofu, opentofu-fips...

GO-2025-4101 vulnerabilities

Vulnerabilities for packages: opentofu...

GO-2025-3413 vulnerabilities

Vulnerabilities for packages: opentofu, terraform, opentofu-fips, vault...

GO-2026-4352 vulnerabilities

Vulnerabilities for packages: opentofu...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: crossplane, kube-arangodb, steampipe, helm-operator-fips, trivy-operator-fips, linkerd2, oras, helm, zarf, kyverno-notation-aws-fips, drone-fips, chartmuseum-fips, kubescape-server, gitlab-operator-fips, redpanda-operator, ocm-kubernetes-controller, argo-cd-fips,...

GO-2026-4352 vulnerabilities

Vulnerabilities for packages: opentofu...

GO-2025-4101 vulnerabilities

Vulnerabilities for packages: opentofu...

GO-2025-3413 vulnerabilities

Vulnerabilities for packages: terraform, opentofu...

GO-2026-5558 vulnerabilities

Vulnerabilities for packages: opentofu...

GO-2025-3922 vulnerabilities

Vulnerabilities for packages: steampipe, k9s, terragrunt, opentofu, podman, trivy, envoy-gateway, undock, kubescape-operator, zot, rancher-fleet, trivy-operator, gitness, filebrowser, gptscript, nsc, guac, tflint, xeol, terraform, grafana-alloy, nuclei, zarf, vcluster, trufflehog, gitleaks...

GO-2026-5058 vulnerabilities

Vulnerabilities for packages: steampipe, k9s, snyk-cli, task, terragrunt, opentofu, trivy, syft, zot, trivy-operator, kubescape, grype, conftest, tflint, xeol, tfsec, terraform, kots, zarf, wolfictl...

GO-2025-3787 vulnerabilities

Vulnerabilities for packages: nerdctl, kor, traefik, argo-workflows, gh, opentelemetry-operator, cilium-cli, terraform-mcp-server, pgtimetable, cosign, opa-envoy, grype, argo-events, kots, zarf, amazon-cloudwatch-agent-operator, cloud-sql-proxy, docker-cli-buildx, kyverno-notation-aws,...

GO-2026-4603 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, crossplane-provider-aws-memorydb, terraform-provider-pagerduty, rancher-agent, sops, kube-rbac-proxy, otel-cli, rancher-helm, tempo, cadvisor, kubo, terraform-provider-grafana, azurefile-csi, runc, kapp-controller, src, blob-csi,...