OpenTofu v1.12.7
security!!
OpenTofu v1.12.7 fixes a deadlock that could occur when remote-exec or file provisioners connect to an attacker-controlled SSH server, where the server could hang the connection by sending unexpected packet types. The release also addresses two upstream Go security advisories, CVE-2026-78662 and CVE-2026-56855.
What changes for platform teams
Platform teams running OpenTofu with provisioners that connect to external hosts should upgrade to pick up the connection-handling fix. The Go advisory fixes are toolchain dependency updates and do not change how platform workflows are run.
Changes
- When using either a remote-exec or file provisioner to connect to an attacker-controlled SSH server, the server could previously deadlock the connection by sending certain unexpected packet types.security
- This addresses the upstream Go security advisories CVE-2026-78662 and CVE-2026-56855.security
2 lines2 securitytyped from the source notes
Full release notes ↗ · all OpenTofu releases
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules