CVE-2026-116683

HIGH7.1

CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values

Published Oct 27, 2026

Modified Today

Details

CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.

References

WEB

https://github.com/ctfer-io/terraform-provider-ctfd/commit/b4acaef1df23ea3ca36936fc2d8ef8d157a58e04

WEB

https://github.com/ctfer-io/terraform-provider-ctfd/pull/376

WEB

https://github.com/ctfer-io/terraform-provider-ctfd/releases/tag/v2.8.2

WEB

https://github.com/ctfer-io/terraform-provider-ctfd/security/advisories/GHSA-vg84-c5mg-76xh

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-116683

CVSS Analysis