GHSA-Q7J3-V8QV-22VQ

While downloading packages from a maliciously crafted URL, some git operations against that URL could allow arbitrary file read.
This might allow disclosure of confidential information.

Details

OpenTofu relies on go-getter for downloading packages like providers and modules. While doing so from a maliciously crafted URL, the operator could be affected by confidential information disclosure.

The go-getter maintainers have recently published CVE-2026-4660 for this library which indirectly affects OpenTofu's behavior.

Typical use of OpenTofu already requires caution in selection of URLs that are used to download modules and providers.

References

• Initial report
• CVE-2026-4660
• OpenTofu v1.12 patch
• OpenTofu v1.11 patch
• Patched v1.12.3 version
• Patched v1.11.10 version

Possible data exposure.

GHSA-Q7J3-V8QV-22VQ has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.11.10, 1.12.3); upgrading removes the vulnerable code path.

Kodem intelligence

OpenTofu v1.11.10 and v1.12.3 address these vulnerabilities by upgrading to the hashicorp/[email protected] that fixes this vulnerability.

The OpenTofu v1.10 series is also impacted by these vulnerabilities. However, that series is built with an older version of the library and upgrading it risks breaking the whole v1.10 series.
For those using OpenTofu v1.10 releases, we recommend planning an upgrade to OpenTofu v1.11.10 in the near future.

1. What is GHSA-Q7J3-V8QV-22VQ? GHSA-Q7J3-V8QV-22VQ is a high-severity security vulnerability in github.com/opentofu/opentofu (go), affecting versions < 1.11.10. It is fixed in 1.11.10, 1.12.3.
2. How severe is GHSA-Q7J3-V8QV-22VQ? GHSA-Q7J3-V8QV-22VQ has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of github.com/opentofu/opentofu are affected by GHSA-Q7J3-V8QV-22VQ? github.com/opentofu/opentofu (go) versions < 1.11.10 is affected.
4. Is there a fix for GHSA-Q7J3-V8QV-22VQ? Yes. GHSA-Q7J3-V8QV-22VQ is fixed in 1.11.10, 1.12.3. Upgrade to this version or later.
5. Is GHSA-Q7J3-V8QV-22VQ exploitable, and should I be worried? Whether GHSA-Q7J3-V8QV-22VQ is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether GHSA-Q7J3-V8QV-22VQ is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix GHSA-Q7J3-V8QV-22VQ?
   • Upgrade github.com/opentofu/opentofu to 1.11.10 or later
   • Upgrade github.com/opentofu/opentofu to 1.12.3 or later