Which versions of Opentofu are affected by CVE-2026-74796?

OpenTofu's provider cache installer (CVE-2026-74796) contains a symlink-traversal vulnerability that allows attackers to write arbitrary files to systems running versions before 1.11.7 or 1.10.10 if…. A patch is available.

How to fix or mitigate CVE-2026-74796?

Within 24 hours, identify and document all systems and developers using OpenTofu versions prior to 1.11.7 or 1.10.10. Within 7 days, upgrade all OpenTofu installations to version 1.11.7 or later (for the 1.11.x branch) or 1.10.10 or later (for the 1.10.x branch), prioritizing development and production environments. Within 30 days, conduct a security audit of infrastructure and configurations deployed using vulnerable OpenTofu versions and implement controls to restrict symlink traversal in working directories.

Opentofu CVE-2026-74796

Q: What is the CVSS score of CVE-2026-74796?

CVE-2026-74796 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-59961 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-08-16 VulnCheck

GHSA-69hj-5jh6-6q99

Information Disclosure Opentofu Red Hat

7.0

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Red Hat

6.1 MEDIUM

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 16, 2026 - 14:13 vuln.today

Analysis Generated

Aug 16, 2026 - 14:13 vuln.today

Patch available

Aug 16, 2026 - 14:01 EUVD

CVE Published

Aug 16, 2026 - 13:14 cve.org

HIGH 7.0

DescriptionCVE.org

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree.

AnalysisAI

OpenTofu's provider cache installer in all versions before 1.11.7 (and 1.10.x before 1.10.10) writes provider package contents to arbitrary filesystem locations when a malicious symlink is pre-positioned inside the .terraform/providers directory, allowing files controlled by the attacker to be placed anywhere the OpenTofu process has write permission. If an attacker can control the contents of a working directory — for instance through a malicious git repository, shared filesystem, or coerced developer workflow — they can include a crafted symlink pointing to a sensitive path outside the working tree, and a subsequent tofu init will follow that symlink and overwrite its target with attacker-supplied provider package content. …