{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-58375", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-16T13:02:14.690Z", "datePublished": "2026-08-16T13:14:03.955Z", "dateUpdated": "2026-08-17T15:35:54.973Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-16T13:14:03.955Z"}, "datePublic": "2024-10-03T00:00:00.000Z", "title": "OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation", "descriptions": [{"lang": "en", "value": "OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead of producing an error. This is fixed in OpenTofu 1.8.3, which adds explicit errors to prevent the use of sensitive values in these contexts."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Exposure of Sensitive System Information to an Unauthorized Control Sphere", "cweId": "CWE-497", "type": "CWE"}]}], "affected": [{"vendor": "opentofu", "product": "opentofu", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "1.8.3"}, {"version": "1.8.3", "status": "unaffected", "versionType": "semver"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://github.com/opentofu/opentofu/security/advisories/GHSA-wpr2-j6gr-pjw9", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-wpr2-j6gr-pjw9)"}, {"name": "VulnCheck Advisory: OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/opentofu-before-secret-variable-leaking-via-static-evaluation"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-17T15:35:43.732346Z", "id": "CVE-2024-58375", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-17T15:35:54.973Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-58375", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-16T13:02:14.690Z", "datePublished": "2026-08-16T13:14:03.955Z", "dateUpdated": "2026-08-17T15:35:54.973Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-16T13:14:03.955Z"}, "datePublic": "2024-10-03T00:00:00.000Z", "title": "OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation", "descriptions": [{"lang": "en", "value": "OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead of producing an error. This is fixed in OpenTofu 1.8.3, which adds explicit errors to prevent the use of sensitive values in these contexts."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Exposure of Sensitive System Information to an Unauthorized Control Sphere", "cweId": "CWE-497", "type": "CWE"}]}], "affected": [{"vendor": "opentofu", "product": "opentofu", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "1.8.3"}, {"version": "1.8.3", "status": "unaffected", "versionType": "semver"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://github.com/opentofu/opentofu/security/advisories/GHSA-wpr2-j6gr-pjw9", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-wpr2-j6gr-pjw9)"}, {"name": "VulnCheck Advisory: OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/opentofu-before-secret-variable-leaking-via-static-evaluation"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-58375", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-17T15:35:43.732346Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-17T15:35:50.389Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "opentofu", "vendor": "opentofu", "versions": [{"lessThan": "1.8.3", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.8.3", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead of producing an error. This is fixed in OpenTofu 1.8.3, which adds explicit errors to prevent the use of sensitive values in these contexts."}], "id": "CVE-2024-58375", "lastModified": "2026-08-17T16:16:46.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58375", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-17T15:35:43.732346Z", "version": "2.0.3"}}]}, "published": "2026-08-16T14:16:53.627", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/opentofu/opentofu/security/advisories/GHSA-wpr2-j6gr-pjw9"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/opentofu-before-secret-variable-leaking-via-static-evaluation"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-497"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/opentofu/opentofu: OpenTofu: Sensitive information disclosure via static evaluation", "id": "2517223", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517223"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-497", "details": ["A flaw was found in OpenTofu. When users enable static evaluation of module sources, versions, and backend configurations, the software does not properly restrict sensitive variables and locals. This oversight can lead to the exposure of values intended to be sensitive through these configuration elements, resulting in an information disclosure vulnerability."], "name": "CVE-2024-58375", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "hi/opentofu", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "opentofu1.10", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "opentofu1.11", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "opentofu1.12", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-08-16T13:14:03Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-58375\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-58375\nhttps://github.com/opentofu/opentofu/security/advisories/GHSA-wpr2-j6gr-pjw9\nhttps://www.vulncheck.com/advisories/opentofu-before-secret-variable-leaking-via-static-evaluation"], "statement": "This Moderate impact flaw in OpenTofu allows sensitive information disclosure when static evaluation of module sources, versions, and backend configurations is enabled. While the vulnerability could expose sensitive variables, the attack complexity is high, requiring specific user configurations to be in place for exploitation.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.8.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.8.3"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "opentofu", "source": "cna", "vendor": "opentofu"}, "product": "opentofu", "vendor": "opentofu"}], "created": "2026-08-16T15:15:04.829197+00:00", "updated": "2026-08-17T10:58:53.014357+00:00", "vendors": ["opentofu", "opentofu$PRODUCT$opentofu"]}