Sensitive Data Exposure in CTFd Terraform Provider by CTFer.io
CVE-2026-116683

7.1HIGH

Key Information:

Vendor

Ctfer-io

Status
Terraform-provider-ctfd
Vendor
CVE Published:
27 October 2026

What is CVE-2026-116683?

The CTFd Terraform Provider by CTFer.io contains a vulnerability where team passwords are stored as non-sensitive values within the Terraform state file. This design flaw allows both local and remote users with access to this state file to easily read the team password without requiring any form of decryption. This exposure poses a risk to the confidentiality of sensitive team credentials, making it essential for users to upgrade to version 2.8.2 or later, where this issue has been resolved.

Affected Version(s)

terraform-provider-ctfd >= 0.1.5, < 2.8.2

References

https://github.com/ctfer-io/terraform-provider-ctfd/secur...
x_refsource_CONFIRM
https://github.com/ctfer-io/terraform-provider-ctfd/pull/376
x_refsource_MISC
https://github.com/ctfer-io/terraform-provider-ctfd/commi...
x_refsource_MISC

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.