Executive brief
OpenTofu is an infrastructure-as-code tool used to provision and manage cloud resources. A flaw in the provider initialization process allows attackers to plant malicious symlinks in a working directory that cause OpenTofu to write files to arbitrary locations on the filesystem, potentially compromising system integrity and enabling attackers to overwrite critical files if the OpenTofu process has sufficient permissions.
Technical details
OpenTofu's provider installer fails to validate and remove pre-existing symlinks in the .terraform/providers directory during initialization (CWE-59: Improper Link Resolution Before File Access). If a symlink already exists at the target path, OpenTofu follows it and installs provider package contents into the symlink target rather than replacing the symlink. An attacker who can control the contents of a working directory (e.g., via a cloned repository or shared workspace) can pre-place a symlink pointing to an arbitrary filesystem location outside the working tree. When a victim runs `tofu init`, the tool writes the provider package into the attacker-controlled symlink target, allowing arbitrary file write to locations accessible by the OpenTofu process. This requires the victim to run `tofu init` in an attacker-controlled directory, but no privilege escalation or authentication is needed. Fixed in OpenTofu 1.11.7, 1.10.10, and 1.12.0.
Affected products
- OpenTofu OpenTofu before 1.11.7
Timeline
- 2026-05-21: disclosed: GHSA-wcmj-x466-56mm published
- 2026-05-21: patched: Fix released in OpenTofu 1.11.7, 1.10.10, and 1.12.0
- 2026-08-16: other: CVE-2026-74796 published