OpenTofu Symlink Attack Leading to Arbitrary File Write

Executive Summary

CVE-2026-74796 is a vulnerability in OpenTofu versions before 1.11.7 where attackers can exploit symlink manipulation during initialization. If a malicious symlink exists in the provider cache directory, running 'tofu init' may cause OpenTofu to write provider files to arbitrary filesystem locations outside the working directory, potentially leading to unauthorized file writes.

Useful 0 Not Useful 0

Detection Guidance

Check for suspicious symlinks in the .terraform/providers directory using commands like 'find .terraform/providers -type l -ls' or 'ls -la .terraform/providers'. Verify provider cache integrity with 'tofu init -reconfigure' to detect mismatches.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to overwrite critical system files or place malicious files in sensitive directories if OpenTofu has sufficient permissions. Users running vulnerable versions may unknowingly execute commands or scripts from attacker-controlled locations, leading to system compromise or data theft.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, potentially violating data integrity and confidentiality requirements under GDPR and HIPAA. Organizations may face compliance violations if sensitive data is exposed or altered due to the exploitation of this issue.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenTofu to version 1.11.7 or later. Remove existing .terraform directories before running 'tofu init' in new directories. Avoid running 'tofu init' in untrusted directories.

Useful 0 Not Useful 0