tfplan2md is a utility that transforms Terraform plan JSON into Markdown reports. A bug in versions before 1.26.1 caused the tool to render sensitive values that should have been masked as "(sensitive)". The weakness is a failure to properly screen confidential data (CWE‑212) and can result in the disclosure of credentials, API keys or other secrets that appear in the generated Markdown.

The vulnerable product is oocx tfplan2md, all releases before 1.26.1. Affected rendering paths include AzApi resource bodies, AzureDevOps variable groups, Scriban template context variables, and hierarchical sensitivity detection. No other products or vendors are listed as affected, and the fix is included in release v1.26.1.

The CVSS score of 8.5 indicates a high severity vulnerability. The EPSS score of less than 1% suggests that exploitation is unlikely at present, and the vulnerability is not in the CISA KEV catalog. Exploitation requires the ability to run tfplan2md against a Terraform plan that contains sensitive data. In many CI/CD pipelines, an internal or compromised user who can invoke the tool or a misconfigured build environment can generate a report that exposes secrets, resulting in a loss of confidentiality.