OpenTofu High CPU Usage Vulnerabilities: CVE-2026-27145, CVE-2026-42504
- Severity
- HIGH
- Affected component
- opentofu (go)
- Affected versions
- >= 1.12.0-beta1, < 1.12.2 or < 1.11.9
- Patched version
- v1.11.9, v1.12.2
OpenTofu users are reportedly affected by high CPU usage when using the K8S remote state backend or parsing specifically crafted TLS certificates from untrusted or compromised servers.
What happened
OpenTofu has been flagged for high CPU usage under specific conditions. This issue manifests when using the K8S remote state backend or when parsing TLS certificates that have been specifically crafted and are sourced from untrusted or compromised servers. It is important to note that these vulnerabilities do not allow for arbitrary code execution or the disclosure of confidential information. The issue was first flagged on 2026-08-20T18:36:22+00:00 and is currently under investigation.
The affected versions of OpenTofu include those greater than or equal to 1.12.0-beta1 and less than 1.12.2 or 1.11.9. Users of these versions are advised to assess their exposure by reviewing their current configurations and usage patterns in relation to the K8S remote state backend and TLS certificate parsing.
What to do about it
- Upgrade to OpenTofu v1.11.9 or v1.12.2 to address these vulnerabilities.
- Review your current usage of the K8S remote state backend and TLS certificate parsing to assess potential exposure.
- Monitor the primary sources for updates on the status of these vulnerabilities and any additional mitigation advice.
How 0Day would have caught this
opentofu is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using OpenTofu versions greater than or equal to 1.12.0-beta1 and less than 1.12.2 or 1.11.9.
What should I do right now?
Upgrade to OpenTofu v1.11.9 or v1.12.2 as soon as possible.
Is this a supply-chain attack?
No, this is not a supply-chain attack. The issue is related to high CPU usage under specific conditions.
Has this been exploited in the wild?
There is no evidence that this vulnerability has been exploited in the wild.