platform
OpenTofu: security advisories, deprecations and releases
Open-source fork of Terraform under the Linux Foundation.
- Items, 90 days
- 12
- Critical
- 0
- Last critical
- none
- This week
- 3
What your digest would have held this week
3 items from the last 7 days. Zero sends only the ones that touch your stack.
Security 3
- HIGH OpenTofu releases · 21 Oct 2026
OpenTofu v1.12.9
OpenTofu v1.12.9 filters out compromised intermediate certificates to prevent trust chain abuse.
- HIGH OpenTofu releases · 14 Oct 2026
OpenTofu v1.12.8 security fix and bug fixes
v1.12.8 fixes a CPU-exhaustion risk during tofu init if an attacker-controlled HTTP2 server is contacted, plus a lifecycle destroy crash.
- MEDIUM OpenTofu releases · 2 Oct 2026
v1.12.7
Fixes a deadlock vulnerability in remote-exec and file provisioners when connecting to a malicious SSH server.
Deprecations 3
- MEDIUM NEW THIS WEEK ACT BY 1 FEB 2027 endoflife.date · 3 Nov 2026
OpenTofu 1.12 reaches end of life on 2027-02-01
OpenTofu 1.12 reaches end of life on 2027-02-01, as listed by endoflife.date.
- LOW ACT BY 1 FEB 2027 endoflife.date · 2 Oct 2026
OpenTofu 1.12 reaches end of life on 2027-02-01
OpenTofu 1.12 reaches end of life on 2027-02-01, as listed by endoflife.date.
- HIGH ACT BY 30 SEPT 2026 endoflife.date · 2 Oct 2026
OpenTofu 1.10 has reached end of life
OpenTofu 1.10 reached end of life on 2026-09-30, as listed by endoflife.date.
Releases 6
- LOW NEW THIS WEEK OpenTofu releases · 29 Oct 2026
OpenTofu v1.12.11 fixes panic in invalid state encryption config
OpenTofu 1.12.11 fixes a panic that could occur when invalid state encryption configuration was provided.
- INFO NEW THIS WEEK OpenTofu releases · 29 Oct 2026
OpenTofu v1.12.10
OpenTofu has released version 1.12.10, updating the infrastructure-as-code tool with the latest fixes and improvements.
- HIGH OpenTofu releases · 21 Oct 2026
OpenTofu v1.13.2 released
OpenTofu 1.13.2 fixes CPU exhaustion via malicious HTTP/2 servers, removes compromised certificate chains, and resolves several CLI crashes and workspace issues.
- LOW OpenTofu releases · 2 Oct 2026
OpenTofu v1.13.1 fixes JSON show and ephemeral outputs
Bug-fix release restoring tofu show -json for plans with ephemeral resources and ensuring ephemeral outputs always refresh during apply.
- INFO OpenTofu releases · 2 Oct 2026
OpenTofu 1.13.0 released
OpenTofu 1.13.0 adds Windows ARM64 builds, new planning functions, early linting and symbol library experiments, and drops WinRM provisioners and 32-bit releases.
- INFO endoflife.date · 2 Oct 2026
OpenTofu 1.13 released
OpenTofu 1.13 was released on 2026-09-30.
Only hear about OpenTofu when it touches your stack
Tell Zero what you run. You get one email, and only on the days something above applies to you.