High severity · published Oct 27, 2026
CVE-2026-116683
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
New
7.1
CVSS
–
EPSS
No
On KEV
Description
CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TE
terraform-provider-ctfd · ctfer-io
>= 0.1.5, < 2.8.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116683
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116683
github.com
https://github.com/ctfer-io/terraform-provider-ctfd/commit/b4acaef1df23ea3ca36936fc2d8ef8d157a58e04
github.com
https://github.com/ctfer-io/terraform-provider-ctfd/pull/376
github.com
https://github.com/ctfer-io/terraform-provider-ctfd/releases/tag/v2.8.2
github.com
https://github.com/ctfer-io/terraform-provider-ctfd/security/advisories/GHSA-vg84-c5mg-76xh