CVE-2026-116683GHSA-VG84-C5MG-76XHEUVD-2026-111358
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.8.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The CTFd Terraform Provider, which lets users manage CTFd capture-the-flag resources as code, is affected. Team passwords are stored in Terraform state as plain, non-sensitive values, so anyone who can access that state, locally or remotely, can read them directly.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- ctfer-io terraform-provider-ctfd
From 0.1.5 · fixed in 2.8.2
- github.com/ctfer-io/terraform-provider-ctfdGo
From 0.1.5 · through 1.1.0
- github.com/ctfer-io/terraform-provider-ctfd/v2Go
fixed in 2.8.2