CVE-2026-74796

OpenTofu versions before 1.11.7 are vulnerable to symlink attack during initialization. When `tofu init` runs, it follows symlinks in the provider cache directory without validation — a malicious symlink can redirect the write operation for provider binaries to any location on the filesystem, achieving arbitrary file write as the process user. This is not a novel vulnerability. It belongs to a 40-year-old vulnerability genotype: security-sensitive path operations that follow symlinks without validation. The same pattern has appeared in package managers (npm, pip, RubyGems), container runtimes, and Unix utilities. The specific mutation here is OpenTofu's init following symlinks in its cache directory, but the underlying failure — treating filesystem structure as implicitly trusted — is identical to past instances. The severity calculus depends heavily on deployment context. In a single-user developer workstation, the prerequisite of local filesystem access bounds the impact. In CI/CD pipelines, particularly shared runners with persistent cache state, the situation reverses: an attacker who places a malicious symlink before a pipeline run can compromise every derived artifact and every subsequent build that inherits that cache. Ephemeral environments don't mitigate this — they make the compromise reproducible and propagable. The trust model at fault: OpenTofu inherited this behavior from Terraform, where the assumption was that the working directory is a trusted execution environment. That assumption made sense when `tofu init` ran on developer laptops. It breaks down in shared development environments, multi-tenant CI runners, and any context where the cache directory outlives a single session. Check your deployment: if OpenTofu runs in CI/CD, verify that the cache directory is either ephemeral (recreated per job) or that workspace isolation exists between runs. The fix in 1.11.7 should address symlink validation, but audit every init/download/cache operation in your toolchain — this genotype tends to express at multiple sites in the same codebase.

Reviewed through automated stages and approved by a human before publication.