OpenTofu versions 1.8.0 through 1.8.2 have a flaw that allows sensitive variables to be exposed when users enable static evaluation of module sources, module versions, or backend configurations. The bug occurs because the software does not enforce its typical restriction and instead returns the sensitive values to configuration elements, compromising confidentiality of data that should remain hidden.

The vulnerability affects all OpenTofu installations running versions 1.8.0, 1.8.1, 1.8.2 that have opted into static evaluation. These are deployments of the opentofu:opentofu product; no specific vendor or subsidiary product beyond OpenTofu is mentioned in the advisory.

The CVSS score of 8.7 classifies the issue as high severity. Exploitation is possible from any user who can provide module source files, specify module versions, or adjust backend configuration in a static‑evaluation context. Because the flaw only leaks data and does not provide an attacker with code execution or privilege escalation, the estimation of risk is that exposed secrets could be used for lateral movement or other operations. The EPSS score is unavailable, and the vulnerability has not been catalogued as a known exploited vulnerability (KEV). The likely attack vector is manipulating module sources or backend settings in environments that enable static evaluation.