OpenTofu versions prior to 1.8.3 are vulnerable to the exposure of sensitive system information during static evaluation, posing a risk of secret leakage.

This vulnerability, identified as CWE-497, involves the improper handling of sensitive variables during static evaluation. An unauthenticated attacker could potentially gain unauthorized access to secrets that are inadvertently exposed during the processing of infrastructure code.

With a CVSS score of 7.5, this vulnerability represents a significant risk to the confidentiality of infrastructure-as-code deployments. Disclosure of secrets such as API keys or cloud credentials could lead to unauthorized access to downstream cloud environments, resulting in data breaches or unauthorized administrative actions.

Immediate Action: Upgrade to OpenTofu version 1.8.3 or later to ensure the fix is applied.

Proactive Monitoring: Review logs for any unexpected access or unusual evaluation patterns within your CI/CD pipelines that utilize OpenTofu.

Compensating Controls: Implement strict secret management practices, such as using dedicated vaults, and ensure that sensitive variables are not persisted in logs or configuration files.

Public Exploit Available: No (unknown).

The risk of secret exposure in infrastructure-as-code tools is severe, as it provides an entry point into cloud environments. All users of OpenTofu must upgrade to version 1.8.3 immediately to prevent the inadvertent disclosure of sensitive credentials.