CVE-2024-58375

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead of producing an error. This is fixed in OpenTofu 1.8.3, which adds explicit errors to prevent the use of sensitive values in these contexts.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/opentofu/opentofu/security/advisories/GHSA-wpr2-j6gr-pjw9
https://www.vulncheck.com/advisories/opentofu-before-secret-variable-leaking-via-static-evaluation

Configurations

No configuration.

History

01 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de OpenTofu 1.8.0 a 1.8.2 no restringen adecuadamente las variables y locales sensibles cuando los usuarios han optado por la evaluación estática de las fuentes de módulos, versiones y configuraciones de backend. Como resultado, los valores marcados como sensibles pueden quedar expuestos a través de estos elementos de configuración en lugar de producir un error. Esto se ha corregido en OpenTofu 1.8.3, que añade errores explícitos para evitar el uso de valores sensibles en estos contextos.

Information

Published : 2026-08-16 14:16

Updated : 2026-10-08 16:16

NVD link : CVE-2024-58375

Mitre link : CVE-2024-58375

CVE.ORG link : CVE-2024-58375

JSON object : View

Products Affected

No product.

CWE

CWE-497

Exposure of Sensitive System Information to an Unauthorized Control Sphere

{"id": "CVE-2024-58375", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58375", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-17T15:35:43.732346Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "opentofu", "product": "opentofu", "versions": [{"status": "affected", "version": "0", "lessThan": "1.8.3", "versionType": "semver"}, {"status": "unaffected", "version": "1.8.3", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/opentofu/opentofu", "defaultStatus": "unaffected"}]}], "published": "2026-08-16T14:16:53.627", "references": [{"url": "https://github.com/opentofu/opentofu/security/advisories/GHSA-wpr2-j6gr-pjw9", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/opentofu-before-secret-variable-leaking-via-static-evaluation", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-497"}]}], "descriptions": [{"lang": "en", "value": "OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead of producing an error. This is fixed in OpenTofu 1.8.3, which adds explicit errors to prevent the use of sensitive values in these contexts."}, {"lang": "es", "value": "Las versiones de OpenTofu 1.8.0 a 1.8.2 no restringen adecuadamente las variables y locales sensibles cuando los usuarios han optado por la evaluaci\u00f3n est\u00e1tica de las fuentes de m\u00f3dulos, versiones y configuraciones de backend. Como resultado, los valores marcados como sensibles pueden quedar expuestos a trav\u00e9s de estos elementos de configuraci\u00f3n en lugar de producir un error. Esto se ha corregido en OpenTofu 1.8.3, que a\u00f1ade errores expl\u00edcitos para evitar el uso de valores sensibles en estos contextos."}], "lastModified": "2026-10-08T16:16:49.483", "sourceIdentifier": "disclosure@vulncheck.com"}