Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-16T13:14:03 github.com/opentofu/opentofu: OpenTofu: Sensitive information disclosure via static evaluation 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-497

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead of producing an error. This is fixed in OpenTofu 1.8.3, which adds explicit errors to prevent the use of sensitive values in these contexts.

A flaw was found in OpenTofu. When users enable static evaluation of module sources, versions, and backend configurations, the software does not properly restrict sensitive variables and locals. This oversight can lead to the exposure of values intended to be sensitive through these configuration elements, resulting in an information disclosure vulnerability.

This Moderate impact flaw in OpenTofu allows sensitive information disclosure when static evaluation of module sources, versions, and backend configurations is enabled. While the vulnerability could expose sensitive variables, the attack complexity is high, requiring specific user configurations to be in place for exploitation. Red Hat Hardened Images Not affected hi/opentofu Red Hat Hardened Images Not affected opentofu1.10 Red Hat Hardened Images Not affected opentofu1.11 Red Hat Hardened Images Not affected opentofu1.12 https://www.cve.org/CVERecord?id=CVE-2024-58375 https://nvd.nist.gov/vuln/detail/CVE-2024-58375 https://github.com/opentofu/opentofu/security/advisories/GHSA-wpr2-j6gr-pjw9 https://www.vulncheck.com/advisories/opentofu-before-secret-variable-leaking-via-static-evaluation