Is CVE-2026-74796 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-74796 being exploited in the wild.

How severe is CVE-2026-74796?

Medium severity, with a CVSS score of 6.1, published 16 August 2026.

Which products and versions are affected?

github.com/opentofu/opentofu (Go) SEMVER:introduced=0,fixed=1.10.10,introduced=1.11.0,fixed=1.11.7, SEMVER:introduced=1.11.0,fixed=1.11.7; OpenTofu before 1.11.7.

Is there a fix for CVE-2026-74796?

Yes. github.com/opentofu/opentofu (Go): upgrade to 1.11.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-74796 attacked?

It is attacked over the network.

Am I affected by CVE-2026-74796?

Check whether you run github.com/opentofu/opentofu (Go) or OpenTofu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-74796: OpenTofu symlink following in provider cache directory

CVE-2026-74796 · Severity: medium · CVSS 6.1 · Published 2026-08-16

OpenTofu is an infrastructure-as-code tool used to provision and manage cloud resources. A flaw in the provider initialization process allows attackers to plant malicious symlinks in a working directory that cause OpenTofu to write files to arbitrary locations on the filesystem, potentially compromising system integrity and enabling attackers to overwrite critical files if the OpenTofu process has sufficient permissions.

Technologies: github.com/opentofu/opentofu (Go), OpenTofu. Vendors: Go, OpenTofu.

Quick answers

Is CVE-2026-74796 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-74796 being exploited in the wild.
How severe is CVE-2026-74796?: Medium severity, with a CVSS score of 6.1, published 16 August 2026.
Which products and versions are affected?: github.com/opentofu/opentofu (Go) SEMVER:introduced=0,fixed=1.10.10,introduced=1.11.0,fixed=1.11.7, SEMVER:introduced=1.11.0,fixed=1.11.7; OpenTofu before 1.11.7.
Is there a fix for CVE-2026-74796?: Yes. github.com/opentofu/opentofu (Go): upgrade to 1.11.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-74796 attacked?: It is attacked over the network.
Am I affected by CVE-2026-74796?: Check whether you run github.com/opentofu/opentofu (Go) or OpenTofu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/opentofu/opentofu (Go): upgrade to 1.11.7 or later
```
go get github.com/opentofu/opentofu@v1.11.7
```

Technical details

OpenTofu's provider installer fails to validate and remove pre-existing symlinks in the .terraform/providers directory during initialization (CWE-59: Improper Link Resolution Before File Access). If a symlink already exists at the target path, OpenTofu follows it and installs provider package contents into the symlink target rather than replacing the symlink. An attacker who can control the contents of a working directory (e.g., via a cloned repository or shared workspace) can pre-place a symlink pointing to an arbitrary filesystem location outside the working tree. When a victim runs `tofu init`, the tool writes the provider package into the attacker-controlled symlink target, allowing arbitrary file write to locations accessible by the OpenTofu process. This requires the victim to run `tofu init` in an attacker-controlled directory, but no privilege escalation or authentication is needed. Fixed in OpenTofu 1.11.7, 1.10.10, and 1.12.0.

Affected products

OpenTofu OpenTofu before 1.11.7

Identifiers

CVE-2026-74796
GHSA-wcmj-x466-56mm
GO-2026-5705

Timeline

2026-05-21: disclosed: GHSA-wcmj-x466-56mm published
2026-05-21: patched: Fix released in OpenTofu 1.11.7, 1.10.10, and 1.12.0
2026-08-16: other: CVE-2026-74796 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.