CVE-2024-58375
Received Received - Intake

OpenTofu Sensitive Data Exposure in Static Evaluation

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: VulnCheck

Description
OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead of producing an error. This is fixed in OpenTofu 1.8.3, which adds explicit errors to prevent the use of sensitive values in these contexts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2024-58375
EUVD
EUVD-2024-55722

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
opentofu opentofu From 1.8.0 (inc) to 1.8.2 (inc)
opentofu opentofu 1.8.3
opentofu opentofu From 0 (inc) to 1.8.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-497 The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects OpenTofu versions 1.8.0 through 1.8.2. When users enable static evaluation of module sources, versions, or backend configurations, sensitive variables and locals are not properly restricted. Instead of producing an error, their values may be exposed in these configurations.

Detection Guidance

Check OpenTofu version with 'tofu version'. If it is 1.8.0 through 1.8.2, the system is vulnerable. Review configurations for module sources, versions, or backend paths using sensitive variables.

Impact Analysis

If you use OpenTofu versions 1.8.0 to 1.8.2 and have enabled static evaluation for module sources, versions, or backend configurations, sensitive data like passwords or API keys could be leaked. This could lead to unauthorized access or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected OpenTofu versions risk non-compliance due to potential data leaks.

Mitigation Strategies

Upgrade to OpenTofu 1.8.3 or later. Avoid using sensitive variables in module sources, versions, or backend paths until upgraded. Temporarily review configurations to ensure no sensitive data is exposed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-58375. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart