Executive brief
OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in github.com/opentofu/opentofu
Affected products
- Go github.com/opentofu/opentofu
Junglewise Threat Intelligence
GO-2026-5571 - OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in github.com/opentofu/opentofu
Severity: info · Published 2026-06-25
Technologies: github.com/opentofu/opentofu (Go). Vendors: Go.
Related threats
- GO-2026-6262 - OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or comp
- OpenTofu denial of service in tofu init with malicious .zip archives
- OpenTofu symlink following in provider cache directory
- GO-2026-5558 - OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server in github.com/opentofu/opento
- GO-2026-5441 - OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses in github.com/