## Summary
OpenTofu 1.8.0 through 1.8.2 can expose values marked sensitive when users opt into static evaluation of module sources, versions, and backend configurations. This is a workflow that should fail with explicit errors, but instead may leak sensitive variables/locals. The issue is fixed in OpenTofu 1.8.3.
## Technical Details
- Affected behavior occurs when static evaluation is enabled for:
- module source and version expressions
- backend configuration values
- Instead of producing an error, OpenTofu may allow sensitive values to flow into these configuration elements, leading to exposure.
- The fix in OpenTofu 1.8.3 adds explicit errors to prevent using sensitive values in these contexts.
- CWE: CWE-497 (Exposure of Sensitive Information).
## Affected
- OpenTofu versions: 1.8.0 through 1.8.2.
- Fixed in: OpenTofu 1.8.3.
- Example risky patterns include:
- variable marked sensitive = true used as backend path (e.g., backend "local" { path = var.backend_path }).
- sensitive variable used as module source (e.g., module "foo" { source = var.mod_info }).
## Impact
- Sensitive variables and locals may be exposed through module source/version and backend configuration elements.
- Attack prerequisites are tied to a user workflow (opting into static evaluation) rather than requiring attacker interaction.
## Mitigation
1. Upgrade OpenTofu to 1.8.3 or later.
2. Review Terraform/OpenTofu configurations and ensure sensitive variables are not used in module source, module version, or backend configuration fields.
3. Validate that configurations that previously relied on static evaluation with sensitive inputs now fail with explicit errors after upgrading.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-497