Executive brief
OpenTofu, an open-source infrastructure-as-code tool, is vulnerable to a data exposure flaw when downloading external modules or providers. An attacker could provide a specially crafted URL that, when processed by OpenTofu, allows them to read sensitive files from the system running the software. This could lead to the theft of confidential configuration files, credentials, or other private data.
Technical details
OpenTofu is affected by a vulnerability in its dependency, hashicorp/go-getter (specifically CVE-2026-4660), which is used to download modules and providers. When OpenTofu performs git operations against a maliciously crafted URL, the go-getter library fails to properly sanitize the input, potentially allowing an attacker to read arbitrary files from the local filesystem of the operator. The vulnerability is reachable over the network if an attacker can influence the source URL of a module or provider. The issue is resolved by upgrading go-getter to version 1.8.6, which is included in OpenTofu versions 1.11.10 and 1.12.3.
Affected products
- OpenTofu OpenTofu < 1.11.10, >= 1.12.0-beta1, < 1.12.3, 1.10.x
Timeline
- 2026-06-18: disclosed: Initial report and pull requests submitted
- 2026-06-19: advisory: GitHub Advisory GHSA-q7j3-v8qv-22vq published
- 2026-06-19: patched: OpenTofu v1.11.10 and v1.12.3 released