CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
GHSA-vg84-c5mg-76xh · CVE-2026-116683 · GO-2026-6868
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
CTFer.io's CTFd Terraform Provider stores ctfd_team.password as non-sensitive values (CWE-522). A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption.
Patches
Patched in v2.8.2.
Workarounds
No workaround exist, yet CTFer.io recommends you keep your state in safe environments with a limited set of users who can access it as a good practice to avoid exploitation of this vulnerability.
References
- WEB https://github.com/ctfer-io/terraform-provider-ctfd/security/advisories/GHSA-vg84-c5mg-76xh
- WEB https://github.com/ctfer-io/terraform-provider-ctfd/pull/376
- WEB https://github.com/ctfer-io/terraform-provider-ctfd/commit/b4acaef1df23ea3ca36936fc2d8ef8d157a58e04
- PACKAGE https://github.com/ctfer-io/terraform-provider-ctfd
- WEB https://github.com/ctfer-io/terraform-provider-ctfd/releases/tag/v2.8.2
Ready to move
Start Securing
Free, no credit card | First findings in minutes