{"id":"CVE-2024-58375","aliases":["GHSA-wpr2-j6gr-pjw9","GO-2024-3182"],"url":"https://o3.security/vulnerability/CVE-2024-58375","summary":"OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation","details":"### Impact\nUsers who have opted into static evaluation of module sources, versions, and backend configurations may be at risk of exposing sensitive variables and locals.  This is a workflow that should not be possible and explicitly show errors.\n\n### Workarounds\nCheck that you are not using sensitive variables in module sources and versions, as well as backend configurations.  The patch will add explicit errors and prevent this from being possible.\n\n### Examples\n```hcl\nvariable \"backend_path\" {\n        type = string\n        sensitive = true\n}\n\nterraform {\n        backend \"local\" {\n                path = var.backend_path\n        }\n}\n```\n\n```hcl\nvariable \"mod_info\" {\n        type = string\n        sensitive = true\n}\n\nmodule \"foo\" {\n        source = var.mod_info\n        //version = var.mod_info\n}\n```\n\n","published":"2026-08-16T13:14:03.955Z","modified":"2026-10-28T02:30:50.176715838Z","cvss":null,"epss":{"score":0.00255,"percentile":0.17241,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/opentofu/opentofu","fixedVersion":"1.8.3"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58375.json"},{"type":"ADVISORY","url":"https://github.com/opentofu/opentofu/security/advisories/GHSA-wpr2-j6gr-pjw9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58375"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/opentofu-before-secret-variable-leaking-via-static-evaluation"},{"type":"PACKAGE","url":"https://github.com/opentofu/opentofu"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2024-3182"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:50.176715838Z"}}