CVE-2026-74796
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree.
Risk Assessment
An attacker can overwrite arbitrary files on the system, potentially leading to system integrity compromise or privilege escalation.
Recommendation
Upgrade OpenTofu to version 1.11.7 or later, which includes validation of symlinks in the cache directory.
Original NVD description (English source)
OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree.