CVE-2026-116683 ยท GHSA-vg84-c5mg-76xh
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
- Risk score
- 53/100
- CVSS
- 7.1 v4.0
- Published
- 27 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.
- Affected
- github.com/ctfer-io/terraform-provider-ctfd (go) >= 0.1.5, <= 1.1.0; github.com/ctfer-io/terraform-provider-ctfd/v2 (go) < 2.8.2
- Fix
- Upgrade github.com/ctfer-io/terraform-provider-ctfd/v2 to 2.8.2 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.1 high
- On your watchlist: terraform, Go
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| github.com/ctfer-io/terraform-provider-ctfd | go | >= 0.1.5, <= 1.1.0 | No fix yet |
| github.com/ctfer-io/terraform-provider-ctfd/v2 | go | < 2.8.2 | 2.8.2 |
References
- https://github.com/advisories/GHSA-vg84-c5mg-76xh
- https://github.com/ctfer-io/terraform-provider-ctfd/security/advisories/GHSA-vg84-c5mg-76xh
- https://github.com/ctfer-io/terraform-provider-ctfd/pull/376
- https://github.com/ctfer-io/terraform-provider-ctfd/commit/b4acaef1df23ea3ca36936fc2d8ef8d157a58e04
- https://github.com/ctfer-io/terraform-provider-ctfd/releases/tag/v2.8.2
- https://github.com/advisories/GHSA-vg84-c5mg-76xh
Original description
CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.
Last activity 27 Oct 2026. Patch Forecast updates every hour.