CyberRota Analysis
AI-GeneratedOpenTofu versions 1.8.0 to 1.8.2 are vulnerable due to improper restrictions on sensitive variables during static evaluation, potentially exposing sensitive information through configuration elements. This flaw could lead to unauthorized access to sensitive data, posing a significant risk to users who rely on these versions for secure configurations. Organizations using OpenTofu should prioritize upgrading to version 1.8.3 to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead of producing an error. This is fixed in OpenTofu 1.8.3, which adds explicit errors to prevent the use of sensitive values in these contexts.