{"id":"GHSA-69hj-5jh6-6q99","revision":null,"records":[{"revision":"1f4e3a7c520b40f58706baff6277dce4","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-74796","aliases":[],"title":"OpenTofu before 1.11.7 Symlink Following Path Traversal","description":"OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree.","state":0,"publishedAt":"2026-08-16T13:14:18.365+00:00","modifiedAt":"2026-10-08T15:24:46.513+00:00","affected":[{"ecosystem":"Vendor product","name":"opentofu","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"opentofu\",\n                    \"product\": \"opentofu\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"1.11.7\"\n                        },\n                        {\n                            \"version\": \"1.11.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:golang/github.com/opentofu/opentofu\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","score":7,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N","score":6.1,"severity":"MEDIUM"}],"references":["https://github.com/opentofu/opentofu/security/advisories/GHSA-wcmj-x466-56mm","https://www.vulncheck.com/advisories/opentofu-before-symlink-following-path-traversal"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74796","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-74796","identifiers":["CVE-2026-74796"]},"retained":false,"historicalAffected":[]},{"revision":"8e441dca5f724879bb0faeb071ab9df6","observedAt":"2026-11-09T15:11:43.996+00:00","statement":{"source":"euvd","id":"EUVD-2026-59961","aliases":["CVE-2026-74796","GHSA-69hj-5jh6-6q99"],"title":"OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents t…","description":"OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","score":7,"severity":null}],"references":["https://github.com/opentofu/opentofu/security/advisories/GHSA-wcmj-x466-56mm","https://www.vulncheck.com/advisories/opentofu-before-symlink-following-path-traversal"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-59961","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 16, 2026, 1:14:18 PM","dateUpdated":"Oct 8, 2026, 3:24:46 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-59961","identifiers":["EUVD-2026-59961","CVE-2026-74796","GHSA-69hj-5jh6-6q99"]},"retained":false,"historicalAffected":[]},{"revision":"b615238a4249497ab09468f7f91d2072","observedAt":"2026-10-25T15:19:09.409+00:00","statement":{"source":"nvd","id":"CVE-2026-74796","aliases":[],"title":"OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents t…","description":"OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree.","state":0,"publishedAt":"2026-08-16T14:16:57.727+00:00","modifiedAt":"2026-10-08T16:17:38.493+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":7,"severity":"HIGH"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N","score":6.1,"severity":"MEDIUM"}],"references":["https://github.com/opentofu/opentofu/security/advisories/GHSA-wcmj-x466-56mm","https://www.vulncheck.com/advisories/opentofu-before-symlink-following-path-traversal"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74796","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-59"],"productCriteria":[],"sourceDates":{"published":"2026-08-16T14:16:57.727","lastModified":"2026-10-08T16:17:38.493"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-74796","identifiers":["CVE-2026-74796"]},"retained":false,"historicalAffected":[]},{"revision":"1505cc4f609c4c2b864f88c4db592be4","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-wcmj-x466-56mm","aliases":["CVE-2026-74796","GO-2026-5705"],"title":"OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree","description":"## Summary\n\nIf a symlink already exists under the `.terraform/providers` directory where a provider package needs to be installed, `tofu init` would follow that symlink and install the new package content into it.\n\nIf an attacker can coerce an operator into running `tofu init` in a directory whose contents are attacker-controlled, they can include such a symlink along with instruction to install an attacker-controlled provider package at the path of that symlink, which would then cause OpenTofu to write the contents of that provider package into an arbitrary directory elsewhere in the filesystem if the OpenTofu process has sufficient permission to write there.\n\n## Details\n\nOpenTofu permits provider cache entries to be symlinks to other locations because that is how the local cache in a specific working directory refers to matching entries in a global cache directory configured in the CLI configuration file.\n\nUnfortunately, OpenTofu's provider installer was missing a rule to remove an existing symlink during installation if it refers to a directory that doesn't already match the expected provider package content. Instead, it would attempt to update the content of the target directory to match the content of the provider package.\n\nIf developers use OpenTofu with the `TF_DATA_DIR` environment variable set, note that the directory they specify in that environment variable is treated as a replacement location for the content that would normally be in the `.terraform` directory, and so it is _that_ location which is sensitive to pre-existing symlinks.\n\nIn the newly-issued versions of OpenTofu, it is now considered an error if any existing directory entry is present in the cache whose content does not already match the expected package content. As before, if an existing entry is present and its content already matches the expected package content then OpenTofu makes no changes to the target directory and just uses it as-is.\n\n## Workaround\n\nIf developers cannot upgrade to a fixed version immediately, OpenTofu recommends that they ensure that there is no `.terraform` directory already present when running `tofu init` for the first time in a new working directory. The absence of that directory guarantees that there cannot be a conflicting symlink.\n\nFor an extra line of defense, verify before running `tofu init` that there are no symlinks anywhere under the current working directory that refer to any path above the current working directory. This limits the scope of attack only to other files in the same working directory, which the attacker already controls in this scenario.\n\n## Notes and Resources\n\n- OpenTofu thanks Francesco Sabiu (@fsabiu) for finding and responsibly disclosing this vulnerability.\n- Generally-speaking, the OpenTofu project expects that operators will run `tofu init` only in directories containing content they trust.\n\n  OpenTofu prioritized addressing this _specific_ concern because a successful attack can write arbitrary files into an arbitrary directory and therefore the potential impact is relatively high and the solution to the problem is low-risk, but this is a pragmatic exception to the usual threat model and there aren't any plans for broader hardening of OpenTofu against attacks of this type. OpenTofu recommends that developers ensure that their working directory contents are as they expect before running `tofu init`.\n\n    In particular: it remains possible for an attacker to place a symlink at some higher point in the directory structure of the provider cache, into which OpenTofu will construct subdirectories needed to create the remaining provider cache directory structure. OpenTofu evaluated that as a less severe concern because it does not give the attacker full control over what is written into the target directory, but note that this does still allow an attacker to write arbitrary content into a directory two levels beneath the target when placing the symlink at the hostname level of the cache directory structure.\n- The original fix for this issue is in https://github.com/opentofu/opentofu/pull/4082. It was backported as follows:\n    - [v1.12 branch](https://github.com/opentofu/opentofu/pull/4087) for v1.12.0\n    - [v1.11 branch](https://github.com/opentofu/opentofu/pull/4088) for v1.11.7\n    - [v1.10 branch](https://github.com/opentofu/opentofu/pull/4089) for v1.10.10","state":0,"publishedAt":"2026-06-23T22:23:01+00:00","modifiedAt":"2026-08-17T03:55:53.3146716+00:00","affected":[{"ecosystem":"Go","name":"github.com/opentofu/opentofu","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.11.0"},{"kind":"fixed","version":"1.11.7"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/opentofu/opentofu","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.10.10"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/opentofu/opentofu/security/advisories/GHSA-wcmj-x466-56mm","https://github.com/opentofu/opentofu"],"sourceUrl":"https://github.com/advisories/GHSA-wcmj-x466-56mm","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-wcmj-x466-56mm","identifiers":["GHSA-wcmj-x466-56mm","CVE-2026-74796","GO-2026-5705"]},"retained":false,"historicalAffected":[]},{"revision":"6b057fffad5d40ac8f1bdd503008b124","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5705","aliases":["CVE-2026-74796","GHSA-wcmj-x466-56mm"],"title":"OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree in github.com/opentofu/opentofu","description":"OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree in github.com/opentofu/opentofu","state":0,"publishedAt":"2026-06-25T22:34:38+00:00","modifiedAt":"2026-08-17T03:55:53.3146716+00:00","affected":[{"ecosystem":"Go","name":"github.com/opentofu/opentofu","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.10.10"},{"kind":"introduced","version":"1.11.0"},{"kind":"fixed","version":"1.11.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/opentofu/opentofu/security/advisories/GHSA-wcmj-x466-56mm"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5705","license":"OSV · upstream source license applies","key":"osv:GO-2026-5705","identifiers":["GO-2026-5705","CVE-2026-74796","GHSA-wcmj-x466-56mm"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T18:23:45.7727801+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T18:23:45.7727801+00:00","lastSuccessAt":"2026-11-10T18:23:45.9579119+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.9579152+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-d220ab899e0e1c49e43094274f562c18c4a19b03898aec3feae1debdd31f6756","complete":true,"records":422212,"lastAttemptAt":"2026-11-10T18:21:27.6685178+00:00","lastSuccessAt":"2026-11-10T18:21:27.4920545+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:21:27.6685178+00:00","snapshotPublishedAt":"2026-11-10T17:27:33+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-acbb624a79c244aa868394151a25f053","complete":true,"records":13704,"lastAttemptAt":"2026-11-10T18:24:12.0072206+00:00","lastSuccessAt":"2026-11-10T18:24:12.001+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:24:12.001+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13758,"expectedIdentifiers":13758,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T18:23:45.7727801+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T18:23:45.7727801+00:00","lastSuccessAt":"2026-11-10T18:23:45.9591411+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.9591459+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-4459456b8f8c43778c308d7de0a43211","complete":true,"records":13710,"lastAttemptAt":"2026-11-10T18:24:11.1447617+00:00","lastSuccessAt":"2026-11-10T18:24:11.141+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:24:11.141+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13758,"expectedIdentifiers":13758,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-50a085e5b7a5d1546eabdb7e52fab85d658afa8554d3cf95a0891c49d83f2979","complete":true,"records":9935,"lastAttemptAt":"2026-11-10T18:23:45.7142755+00:00","lastSuccessAt":"2026-11-10T16:25:20.0114252+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.7142755+00:00","snapshotPublishedAt":"2026-11-10T16:18:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T18:21:27.7170016+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:21:27.7170016+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-df497239f2f75af38e095cb498791dad4044a8a9a7f5f0ee6008bb732579ab9d","complete":true,"records":3081,"lastAttemptAt":"2026-11-10T18:23:45.7340645+00:00","lastSuccessAt":"2026-11-10T14:21:34.3717399+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.7340645+00:00","snapshotPublishedAt":"2026-11-10T14:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-5bab1d7e68ac802e78d67f5b951f7bcace0c45048e98b39b73b18376172e4b36","complete":true,"records":231619,"lastAttemptAt":"2026-11-10T18:23:45.5819776+00:00","lastSuccessAt":"2026-11-10T18:23:44.1117746+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.5819776+00:00","snapshotPublishedAt":"2026-11-10T17:33:21+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}