OpenTofu

OpenTofu now prevents an attacker-controlled SSH server from deadlocking a connection established via the remote-exec or file provisioner by sending unexpected packet types, addressing upstream Go security advisories CVE-2026-78662 and CVE-2026-56855. No action is required beyond upgrading since this is a non-breaking fix.

Matters for: Relevant for teams running OpenTofu provisioners that connect to remote or third-party SSH servers during infrastructure provisioning.

OpenTofu 1.13.0 adds official Windows on ARM64 packaged releases and introduces new functions letting module authors supply hints that reduce unknown values during planning, alongside early linting and symbol library experiments. The release drops WinRM support for provisioners, raises the macOS requirement to Ventura (13) or later, changes base64gzip output to be non-byte-identical due to a Golang upgrade, and marks this as the last series with official 32-bit CPU builds, so affected pipelines must remove WinRM provisioner usage, update macOS build agents, and adjust any logic comparing base64gzip output byte-for-byte.

Matters for: Teams running Terraform/OpenTofu provisioners over WinRM, maintaining 32-bit CI build agents, or using macOS runners older than Ventura for infrastructure automation.

OpenTofu 1.12.5 patches a vulnerability in the Encrypted Client Hello implementation used via the Go standard library, where pre-shared key identities were leaked during the handshake, letting a passive network observer de-anonymize the server hostname even when ECH was in use. It also fixes a bug where implicit moves and provider address changes incorrectly triggered providers.MovedResourceState instead of providers.UpgradeResourceState.

Matters for: Relevant for teams running OpenTofu v1.12.x in environments where network traffic may be passively observed and hostname confidentiality matters, such as regulated infrastructure at organizations like Boeing, Capital One, or AMD.