# OpenTofu v1.12.6

- Product: OpenTofu (https://whatsnew.fyi/product/opentofu)
- Vendor: Linux Foundation
- Date: 2026-08-19
- Version: v1.12.6
- Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.12.6
- Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.12.6

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix incorrect resending of credentials to HTTP redirect targets when interacting with OCI Distribution registries for module or provider package installation
- **security** — Fix potential high CPU and memory usage in tofu init when resolving crafted relative URLs in API responses from attacker-controlled remote state backends or registries

##### SECURITY ADVISORIES:

- When interacting with OCI Distribution registries for module or provider package installation, earlier versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. ([#4422](https://github.com/opentofu/opentofu/pull/4422))
- When interacting with an attacker-controlled remote state backend or provider/module registry, `tofu init` in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses. ([#4472](https://github.com/opentofu/opentofu/pull/4472))

**Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.12.5...v1.12.6