Bug 2517747

Summary: CVE-2026-74796 opentofu: OpenTofu: Arbitrary file write via symlink following path traversal [fedora-all]
Product: [Fedora] Fedora Reporter: Srikanth Balasubramanian <sbalasub>
Component: opentofuAssignee: Mikel Olasagasti Uranga <mikel>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: go-sig, mikel
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["47504333-7b38-4966-a0ce-94fbc3640bb4"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2517217    

Description Srikanth Balasubramanian 2026-08-18 10:06:34 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree.