OpenTofu v1.12.6 security advisories

{
  "id": "593ad7aa9975eaaa643344baff7ce378d51d3e97532073a4823f0f8020cd76ad",
  "url": "https://github.com/opentofu/opentofu/releases/tag/v1.12.6",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "OpenTofu v1.12.6 security advisories",
    "summary": "OpenTofu v1.12.6 addresses credential forwarding to redirected OCI Distribution registry targets and potential high CPU or memory use while resolving crafted relative URLs from an attacker-controlled backend or registry.",
    "evidence": "Release notes from opentofu\nv1.12.6\n\nSECURITY ADVISORIES: When interacting with OCI Distribution registries for module or provider package installation, earlier versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. (#4422) When interacting with an attacker-controlled remote state backend or provider/module registry, tofu init in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses. (#4472) Full Changelog: v1.12.5...v1.12.6",
    "products": [
      {
        "name": {
          "value": "OpenTofu",
          "evidence": "earlier versions of OpenTofu"
        },
        "prerequisites": [
          {
            "value": "When interacting with OCI Distribution registries for module or provider package installation",
            "evidence": "When interacting with OCI Distribution registries for module or provider package installation"
          },
          {
            "value": "When interacting with an attacker-controlled remote state backend or provider/module registry",
            "evidence": "When interacting with an attacker-controlled remote state backend or provider/module registry"
          }
        ],
        "fixed_versions": [
          {
            "value": "v1.12.6",
            "evidence": "v1.12.6"
          }
        ],
        "affected_versions": [
          {
            "value": "earlier versions of OpenTofu",
            "evidence": "earlier versions of OpenTofu could incorrectly resend credentials"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-opentofu-opentofu",
  "document_id": 22065,
  "published_at": "2026-08-19T11:40:07+00:00"
}