tag: Opentofu · 9 items
- Platform/SRE — Plan: Upgrade OpenTofu to v1.12.8 to address a CPU exhaustion vulnerability reachable via attacker-controlled HTTP/2 servers during
tofu init; no KEV listing or active exploitation reported, so no hard deadline, but schedule patching this sprint. - CI/CD — Plan: If pipelines run
tofu initagainst untrusted or external registries, upgrade to v1.12.8 to close the HTTP/2 CPU exhaustion vector; no confirmed exploitation or pipeline-breaking deadline, so plan within current cycle. - Leader — Skip
- Platform/SRE — Learn: Oracle’s adoption of OpenTofu adds credibility to the fork as a production-grade Terraform alternative, reinforcing the case for teams still evaluating their IaC path after HashiCorp’s BSL relicensing — but no deadline or forced action exists here.
- CI/CD — Skip
- Leader — Plan: A major cloud vendor publicly standardizing on OpenTofu is a meaningful market signal; if your org hasn’t yet resolved its Terraform-vs-OpenTofu strategy following the 2023 BSL license change, schedule that evaluation this quarter before toolchain drift makes migration harder.
- Platform/SRE — Plan: Upgrade OpenTofu to v1.12.7 to address CVE-2026-78662 and CVE-2026-56855, which allow an attacker-controlled SSH server to deadlock remote-exec/file provisioner connections; neither CVE is KEV-listed and EPSS scores are near zero, so schedule within the next IaC toolchain maintenance cycle rather than treating as an emergency.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-56855 — CISA KEV: not listed, EPSS 0.01 · CVE-2026-78662 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: GA IaC release with real breaking changes: WinRM provisioner removed, macOS 13 Ventura now minimum, and 1.13.x will be the last series supporting 32-bit CPUs — audit current usage of these before upgrading, and plan the 32-bit migration for the next cycle.
- CI/CD — Plan: If OpenTofu runs inside pipelines (infra provisioning steps), audit for WinRM provisioner usage and verify the base64gzip output change doesn’t break deterministic artifact checks before scheduling the upgrade.
- Leader — Learn: OpenTofu 1.13’s healthy GA cadence (new planning primitives, upcoming linting/policy experiment) reinforces confidence in the Terraform-alternative bet, but there is no licensing, pricing, or vendor-risk development requiring a leadership decision here.
- Signals: OpenTofu 1.13 EOL 2027-08-01 · deprecation mentioned (no explicit date found)
- Platform/SRE — Act: OpenTofu 1.11 hit EOL on 2026-08-19 and this is its final patch; the credential-leak via OCI HTTP redirect and the DoS via crafted remote-state URLs are both active security risks in IaC runs. Upgrade to a supported OpenTofu release series (1.12+) now that EOL has passed.
- CI/CD — Act: The credential-leak bug affects
tofu initwhen pulling modules or providers from OCI registries — a standard pipeline step — and could expose registry credentials to a redirect target. Upgrade the OpenTofu version pinned in CI pipelines from 1.11.x to a supported series immediately; 1.11 is already EOL. - Leader — Skip
- Signals: OpenTofu 1.11 is past EOL (2026-08-19, 5d ago)
- Platform/SRE — Plan: Two security fixes affect IaC workflows: credentials intended for an OCI registry origin can leak to HTTP redirect targets, and tofu init can be forced into high CPU/memory usage via crafted URLs from an attacker-controlled state backend or registry. Upgrade OpenTofu to 1.12.6 in your IaC toolchain this sprint; no KEV listing or confirmed active exploitation, but both issues are directly triggerable in adversarial environments.
- CI/CD — Plan: If tofu init runs in your pipelines against external module/provider registries or remote state backends, both the credential-leak and resource-exhaustion issues apply there too. Pin the OpenTofu version in your pipeline tooling to 1.12.6 as part of your next dependency update cycle.
- Leader — Skip
- Platform/SRE — Plan: Platform engineers running OpenTofu should upgrade to 1.12.5 to address the ECH handshake privacy leak (server hostname de-anonymization via passive observation) and the implicit-move provider state bug; no KEV listing or active exploitation reported, so no hard deadline, but this should be included in the next IaC toolchain update cycle.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: A security fix for an ECH pre-shared key identity leak in OpenTofu v1.11.x warrants upgrading to v1.11.13; no KEV listing or active exploitation reported, so this is a planned patch rather than an emergency — schedule the upgrade this sprint.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Oracle’s enterprise-scale migration validates OpenTofu as production-ready; teams running Terraform under the BUSL license should schedule an evaluation of OpenTofu as a drop-in replacement within the next planning cycle.
- CI/CD — Skip
- Leader — Plan: A major cloud vendor publicly switching to the OpenTofu fork is a clear signal that the fork has enterprise momentum; leaders standardized on Terraform should put an OpenTofu migration evaluation on the roadmap to reduce BUSL licensing risk before it becomes a contractual concern.