Go/github.com/opentofu/opentofu CVE-2026-74796: medium 6.1, EPSS 0.34%
OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree
Action: Upgrade github.com/opentofu/opentofu to 1.10.10 or later.
go get github.com/opentofu/opentofu@v1.11.7go get github.com/opentofu/opentofu@v1.10.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.11.0 | 1.11.7 | - |
| 0 | 1.10.10 | - |
Fixed versions
| 1.11.7 | 1.10.10 |
Sources
- osv: GHSA-wcmj-x466-56mm
- https://github.com/opentofu/opentofu/security/advisories/GHSA-wcmj-x466-56mm
- https://github.com/opentofu/opentofu
CVE-2026-74796 · published · modified · JSON