Read the docs
TI-2026-81513 Aliases CVE-2026-116683GHSA-vg84-c5mg-76xh

CTFd Terraform Provider exposes team passwords in Terraform state

Priority LOW 31CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-522.

Summary

CTFer.io's CTFd Terraform Provider from 0.1.5 before 2.8.2 stores the ctfd_team.password attribute in Terraform state as a non-sensitive value (CWE-522). A local or remote user with access to that state can read team passwords without any additional decryption step.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00379 32nd percentileScored 2026-11-07
Fix Fixed terraform-provider-ctfd (ctfer-io): 2.8.2github.com/ctfer-io/terraform-provider-ctfd/v2 (Go): 2.8.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ctfer-ioterraform-provider-ctfd0.1.5 to before 2.8.22.8.2Patch availableCNA
—github.com/ctfer-io/terraform-provider-ctfd (Go)0.1.5 – 1.1.0—No fix listedGHSA-vg84-c5mg-76xh
—github.com/ctfer-io/terraform-provider-ctfd/v2 (Go)before 2.8.22.8.2Patch availableGHSA-vg84-c5mg-76xh
  • terraform-provider-ctfd Vendorctfer-io Affected 0.1.5 to before 2.8.2 Fixed in 2.8.2 Patch available CNA
  • github.com/ctfer-io/terraform-provider-ctfd (Go) Vendor— Affected 0.1.5 – 1.1.0 Fixed in — No fix listed GHSA-vg84-c5mg-76xh
  • github.com/ctfer-io/terraform-provider-ctfd/v2 (Go) Vendor— Affected before 2.8.2 Fixed in 2.8.2 Patch available GHSA-vg84-c5mg-76xh

Remediation

Upgrade terraform-provider-ctfd and github.com/ctfer-io/terraform-provider-ctfd/v2 to 2.8.2, which fixes the issue. The sources list no fixed version for github.com/ctfer-io/terraform-provider-ctfd.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA terraform-provider-ctfd (ctfer-io) Fixed in 2.8.2
  • Fix · GHSA-vg84-c5mg-76xh github.com/ctfer-io/terraform-provider-ctfd/v2 (Go) Fixed in 2.8.2 Advisory →

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-116683
  2. 2026-10-27 Alias added: GHSA-vg84-c5mg-76xh
  3. 2026-10-28 Priority changed: MEDIUM → LOW
  4. 2026-11-03 CISA SSVC decision points changed

References

Other 5

  • TI-2026-25275 Romeo is vulnerable to Archive Slip due to missing checks in sanitization CVSS 4.0HIGH 8.3
  • TI-2026-25260 Monitoring is vulnerable to Archive Slip due to missing checks in sanitization CVSS 4.0HIGH 8.8
  • TI-2025-33561 Chall-Manager's HTTP Gateway have no header check timeout leading to potential slow loris attacks CVSS 4.0HIGH 8.7
  • TI-2025-33560 Chall-Manager's scenario decoding process does not check for zip bombs CVSS 4.0HIGH 8.7
  • TI-2026-25229 Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace CVSS 4.0HIGH 7.9
  • TI-2026-25257 Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace CVSS 4.0HIGH 7.9
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences