Description
CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.
Published: 2026-10-27
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Confidential data exposure (team passwords)
Action: Patch Immediately
AI Analysis

Impact

The Terraform Provider for CTFd stores team passwords as non-sensitive values in the state file for versions 0.1.5 through 2.8.2. A user with local or remote read access to that file can retrieve the plain text passwords, enabling credential compromise of teams within the CTFd platform.

Affected Systems

CTFer.io's Terraform provider for CTFd (ctfer-io:terraform-provider-ctfd) in versions 0.1.5 through 2.8.2.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.1, indicating high severity. Exploitation requires only ability to read the state file—accessible locally or via exposed remote backends—making the attack path straightforward for anyone who can view or download the state. No publicly known exploits are listed in CISA KEV, but the exposure of passwords can lead to full team compromise and potential escalation within the CTFd environment.

Generated by OpenCVE AI on October 27, 2026 at 19:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Terraform provider version 2.8.2 or later, where passwords are stored as sensitive values
  • Restrict filesystem and network access to Terraform state files to trusted users and services only
  • Implement state file encryption through a remote backend or Terraform Cloud/Enterprise to protect credentials at rest

Generated by OpenCVE AI on October 27, 2026 at 19:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-vg84-c5mg-76xh CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
History

Tue, 27 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.
Title CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
Weaknesses CWE-522
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:L/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-27T18:25:50.885Z

Reserved: 2026-10-26T20:00:59.829Z

Link: CVE-2026-116683

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T19:17:11.047

Modified: 2026-10-27T19:17:11.047

Link: CVE-2026-116683

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T19:30:09Z

Weaknesses
  • CWE-522

    Insufficiently Protected Credentials