The Terraform Provider for Linode writes authentication keys, passwords, and other sensitive data to debug logs when the provider is compiled with debug logging enabled, without redacting these values. A privileged user who can view the logs—such as a developer, CI/CD runner, or system administrator with access to aggregated log stores—can read credentials, manage tokens, and retrieve StackScript contents stored in the logs. The vulnerability is a classic instance of CWE‑532, where sensitive information is recorded in application logs. The likely attack vector is enabling the provider’s debug mode, which is normally off by default but may be turned on for troubleshooting or when running build pipelines. The disclosure potential arises not from an external network exploit but from internal access to the logs, so the vulnerability’s threat surface depends on the security of the logging infrastructure. Though the CVSS score is 5, indicating moderate severity, the EPSS score is less than 1 % and the issue is not listed as Known Exploited, its exposure of credentials can be fatal if privileged individuals or compromised CI systems gain access to the logs. The consequence is loss of confidentiality and potential compromise of authenticated resources on Linode.

Linode Terraform provider for versions before 3.9.0. The affected product includes all releases of the Linode provider distributed through Terraform, prior to the 3.9.0 release that introduced log sanitization. The vulnerability applies to all operating environments where provider debug logging might be enabled.

The risk is moderate, as indicated by CVSS 5, but the exploitation hinges on an internal actor’s ability to read provider debug logs. Because debug logging is disabled by default and the EPSS score is very low, the likelihood of accidental exploitation is small. However, when debug logging is actively enabled—for instance during local debugging, CI/CD runs, or centralized log collection—the attacker could read or export logs and obtain credentials or scripts, especially if those logs are retained and shared. The status in CISA’s KEV catalog is not listed, meaning there is no known mass exploitation yet. The broader CISA KEV listing suggests that securing log access and disabling debug output are effective mitigations.