cyfenced.com →

[ CVE-2026-116683 · Published 27 Oct 2026 ]

CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values

CVSS 7.1 EPSS <1%Fix available

[ Description ]Official description

CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.

[ Fixes ]Fixes and patches

[ Packages ]Affected open-source packages

  • github.com/ctfer-io/terraform-provider-ctfd goAffected >= 0.1.5, <= 1.1.0 · GHSA-vg84-c5mg-76xh
  • github.com/ctfer-io/terraform-provider-ctfd/v2 goAffected < 2.8.2 · fixed in 2.8.2 · GHSA-vg84-c5mg-76xh

[ References ]References