CVE-2026-74796 in OpenTofu
Summary
by MITRE • 08/16/2026
OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/16/2026
The vulnerability identified in OpenTofu versions prior to 1.11.7 represents a critical path traversal and symbolic link following issue within the infrastructure-as-code tooling ecosystem. During the initialization phase, specifically when executing tofu init, the application is responsible for downloading and installing provider plugins into a designated cache directory. The core technical flaw lies in the failure of the software to adequately validate existing symlinks present within this provider cache directory before proceeding with file write operations. This oversight allows an attacker who has access to place files or directories within the trusted working directory, including those that are symbolic links pointing to arbitrary locations on the host filesystem outside the scope of the project tree.
From a technical perspective, when OpenTofu attempts to unpack provider package contents, it does not sufficiently check whether target paths resolve through symlinks to unintended destinations. Consequently, if an attacker pre-positions a malicious symlink in the expected cache location or within the working directory structure that points to a sensitive system path, such as /etc/passwd, a configuration file with elevated privileges, or another critical application data store, the initialization process will blindly follow this link and write the provider binary contents directly into the target location. This behavior effectively bypasses standard sandboxing expectations where tool outputs are confined to their designated directories, leading to arbitrary file overwrite conditions that can be exploited for further system compromise.
The operational impact of this vulnerability is severe due to its potential for remote code execution or privilege escalation depending on the context in which OpenTofu runs. If an attacker can trick a developer or a continuous integration pipeline into running tofu init within a controlled environment where they have write access, they can overwrite critical system files. For instance, overwriting executable binaries with malicious versions of provider plugins could lead to code execution during subsequent plan or apply operations. Furthermore, if the tool is executed with elevated privileges in an automated deployment pipeline, this vulnerability becomes a potent vector for lateral movement and persistent backdoor installation across the infrastructure managed by that specific configuration state.
This flaw aligns closely with CWE-59 Improper Link Resolution Before File Access, as it involves following symbolic links to access files outside of intended directories without proper validation. Additionally, from an offensive security perspective such as MITRE ATT&CK, this behavior facilitates techniques related to Path Traversal and potentially Command and Control if the overwritten binaries are used for malicious purposes during subsequent Terraform/OpenTofu runs. The lack of strict path canonicalization or symlink verification allows attackers to manipulate file system interactions in ways that undermine the integrity of the infrastructure-as-code workflow.
To mitigate this risk, organizations must immediately upgrade OpenTofu to version 1.11.7 or later where these validation checks have been implemented and hardened. In environments where upgrading is not instantly feasible, strict access controls should be enforced on working directories to prevent unauthorized users from creating symlinks within the provider cache paths. Additionally, running infrastructure-as-code tools with least-privilege principles in isolated containers or virtual machines can limit the blast radius of any successful exploitation attempt by restricting write permissions to only necessary and monitored locations. Regular auditing of directory structures for unexpected symbolic links is also recommended as a defensive measure against this class of path traversal vulnerabilities.