~ / search / GHSA-vg84-c5mg-76xh

GHSA-vg84-c5mg-76xh

CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values

Source: GitHub Advisory Database (reviewed) High CVE-2026-116683

Packages

EcosystemPackageAffectedFixed in
Go github.com/ctfer-io/terraform-provider-ctfd >= 0.1.5, <= 1.1.0 no fix listed
Go github.com/ctfer-io/terraform-provider-ctfd/v2 < 2.8.2 2.8.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact CTFer.io's CTFd Terraform Provider stores `ctfd_team.password` as non-sensitive values (CWE-522). A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption. ### Patches Patched in v2.8.2. ### Workarounds No workaround exist, yet CTFer.io recommends you keep your state in safe environments with a limited set of users who can access it as a good practice to avoid exploitation of this vulnerability.

References

External links from the advisory. They lead to third-party sites.