Plan active

OpenTofu v1.12.7 patches SSH provisioner deadlock CVEs

2026-10-05 20:27 UTC · Releases: opentofu · read the source ↗ #opentofu #security #iac

Platform/SRE — Plan: Upgrade OpenTofu to v1.12.7 to address CVE-2026-78662 and CVE-2026-56855, which allow an attacker-controlled SSH server to deadlock remote-exec/file provisioner connections; neither CVE is KEV-listed and EPSS scores are near zero, so schedule within the next IaC toolchain maintenance cycle rather than treating as an emergency.
CI/CD — Skip
Leader — Skip
Signals: CVE-2026-56855 — CISA KEV: not listed, EPSS 0.01 · CVE-2026-78662 — CISA KEV: not listed, EPSS 0.00

This entry was curated and judged by AI (Claude) with automated enrichment (CISA KEV / EPSS / public PoC). Verify against the original source before acting. Found a bad verdict? Report it — confirmed errors go to the corrections log.