CLEANSTART-2026-ZX60519 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

Security vulnerability affects the opentofu package. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards...

CLEANSTART-2026-IX31999 OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys

Security vulnerability affects the opentofu package. OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys...

CLEANSTART-2026-VV62623 HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries

Security vulnerability affects the opentofu package. HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries...

CLEANSTART-2026-RM80013 xz is a pure golang package for reading and writing xz-compressed files

Security vulnerability affects the opentofu package. xz is a pure golang package for reading and writing xz-compressed files...

CLEANSTART-2026-CM55166 flaw was found in CIRCL's implementation of the FourQ elliptic curve

Security vulnerability affects the opentofu package. A flaw was found in CIRCL's implementation of the FourQ elliptic curve...

CLEANSTART-2026-XL92332 Security fix for GHSA-xmrv-pmrh-hhx2 applied in: opentofu 1.11.13-r1, trivy 0.69.3-r1, grafana 12.2.8-r1, grafana 12.3.6-r0, grafana-fips 12.2.8-r0, grafana 12.1.10-r3, grafana-fips 12.3.6-r0, grafana-fips 13.0.0-r0, grafana 12.0.10-r2, grafana 12.1.7-r2, loki 3.6.10-r1, grafana 12.2.5-r1, grafana 12.4.2-r0

GHSA-xmrv-pmrh-hhx2 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MR03784 Security fix for GHSA-vh4v-2xq2-g5cg applied in: opentofu 1.11.13-r1, opentofu 1.11.13-r2, opentofu 1.11.13-r3, consul-k8s 2.0.1-r1, consul-k8s 2.0.1-r2, consul-k8s 2.0.1-r3, trivy 0.69.3-r3

GHSA-vh4v-2xq2-g5cg affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HG96871 HashiCorp’s go-getter library up to v1

Security vulnerability affects the opentofu package. HashiCorp’s go-getter library up to v1...

CLEANSTART-2026-KW07781 Security fix for GHSA-78h2-9frx-2jm8 applied in: step-ca 0.30.2-r1, step-ca 0.30.2-r2, step-ca-fips 0.30.2-r1, trillian-fips 1.7.3-r1, kaniko 1.24.0-r2, cert-manager 1.19.4-r1, opentofu-fips 1.9.4-r5, opentofu-fips 1.7.10-r5, opentofu-fips 1.8.11-r5, kyverno-fips 1.13.6-r9, jitsucom-bulker 2.10.0-r0

GHSA-78h2-9frx-2jm8 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XC19453 Security fix for GHSA-78h2-9frx-2jm8 applied in: bank-vaults 1.32.1-r1, opentofu-fips 1.10.9-r4, openbao 2.5.4-r1, velero 1.16.2-r5, temporal-server-fips 1.31.1-r1, opentofu-fips 1.11.5-r3, consul 1.20.6-r0, thanos 0.41.0-r0, fulcio 1.8.7-r2

GHSA-78h2-9frx-2jm8 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-RD24544 Security fix for GHSA-xmrv-pmrh-hhx2 applied in: bank-vaults 1.32.1-r1, grafana 13.0.0-r0, rclone 1.72.1-r4, velero 1.16.2-r4, velero 1.16.2-r5, opentofu 1.12.7-r1, velero-plugin-for-aws 1.11.1-r3, rqlite 9.4.5-r5

GHSA-xmrv-pmrh-hhx2 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

ROOT-APP-GOBINARY-GHSA-Q7J3-V8QV-22VQ GHSA-q7j3-v8qv-22vq in github.com/opentofu/opentofu - Patched by Root

Root has patched GHSA-q7j3-v8qv-22vq in the github.com/opentofu/opentofu package for Root:Go. Multiple fixed versions available...

PT-2026-135395

Root has patched GHSA-q7j3-v8qv-22vq in the github.com/opentofu/opentofu package for Root:Go. Multiple fixed versions available...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: opentofu1.12: opentofu1.12-1.12.7-0.2.hum1 aarch64, s390x, x8664 opentofu1.12-1.12.7-0.2.hum1.src src...

CLEANSTART-2026-SO98691 Security fix for GHSA-r92c-9c7f-3pj8 applied in: opentofu 1.11.4-r0

Security vulnerability affects the opentofu package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-116523

Security vulnerability affects the opentofu package. This issue is resolved in later releases. See references for vulnerability details...

GO-2026-6497 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, k8sgpt, kargo, helm-push, flux-helm-controller, kyverno-notation-aws, helm-set-status, rancher-helm, cluster-api-helm-controller, opentofu, manifest-tool, helm-mapkubeapis, k9s, xeol, kube-arangodb, gitness, maru...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, k8sgpt, kargo, helm-push, flux-helm-controller, kyverno-notation-aws, helm-set-status, rancher-helm, cluster-api-helm-controller, opentofu, manifest-tool, helm-mapkubeapis, k9s, xeol, kube-arangodb, gitness, maru...

GO-2026-6508 vulnerabilities

Vulnerabilities for packages: harbor-registry, mcp-grafana, fluent-bit-plugin-loki, grafana-alloy, kots, caddy, grafana-pyroscope, tempo, distribution, aws-otel-collector, loki, grafana, traefik, zot, datadog-agent, amazon-cloudwatch-agent, opentofu, pulumi-kubernetes-operator, grafana-mimir,...

OpenTofu DoS

The vulnerability of the OpenTofu infrastructure management tool is related to the presence of vulnerabilities in the borrowed components. Exploiting these vulnerabilities can allow a malicious actor, operating remotely, to cause service failures...