PT-2026-73142 · Opentofu · Opentofu

CVE-2024-58375

·

Published

2024-10-03

·

Updated

2026-08-17

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions OpenTofu versions 1.8.0 through 1.8.2
Description Sensitive variables and locals are not properly restricted when static evaluation of module sources, versions, and backend configurations is enabled. This allows values marked as sensitive to be exposed through these configuration elements instead of triggering an error.
Recommendations Update to version 1.8.3.

Exploit

Fix

Information Disclosure

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-200CWE-497

Related Identifiers

CVE-2024-58375
GHSA-WPR2-J6GR-PJW9
GO-2024-3182

Affected Products

Opentofu