tocsin

Go/github.com/opentofu/opentofu CVE-2026-74796: unknown, EPSS 0.34%

OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree in github.com/opentofu/opentofu

Action: Upgrade github.com/opentofu/opentofu to 1.10.10 or later.

go get github.com/opentofu/opentofu@v1.10.10
go get github.com/opentofu/opentofu@v1.11.7

Affected

introducedfixedlast affected
01.10.10-
1.11.01.11.7-

Fixed versions

1.10.101.11.7

Sources

CVE-2026-74796 · published · modified · JSON