CVE-2026-116683
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.
- Record
CVE-2026-116683- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-522
- Updated
- 2026-11-03
EUVDEUVD-2026-111358
CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.
- Record
EUVD-2026-111358- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:L/SA:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vg84-c5mg-76xh
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
Impact
CTFer.io's CTFd Terraform Provider stores ctfd_team.password as non-sensitive values (CWE-522). A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption.
Patches
Patched in v2.8.2.
Workarounds
No workaround exist, yet CTFer.io recommends you keep your state in safe environments with a limited set of users who can access it as a good practice to avoid exploitation of this vulnerability.
- Record
GHSA-vg84-c5mg-76xh- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-522
- Updated
- 2026-11-02
NVD
CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.
- Record
CVE-2026-116683- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-522
- Updated
- 2026-11-03
OSV
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.
- Record
CVE-2026-116683- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-522
- Updated
- 2026-11-06
OSVGHSA-vg84-c5mg-76xh
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
Impact
CTFer.io's CTFd Terraform Provider stores ctfd_team.password as non-sensitive values (CWE-522). A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption.
Patches
Patched in v2.8.2.
Workarounds
No workaround exist, yet CTFer.io recommends you keep your state in safe environments with a limited set of users who can access it as a good practice to avoid exploitation of this vulnerability.
- Record
GHSA-vg84-c5mg-76xh- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-522
- Updated
- 2026-11-06
OSVGO-2026-6868 No score
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values in github.com/ctfer-io/terraform-provider-ctfd
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values in github.com/ctfer-io/terraform-provider-ctfd
- Record
GO-2026-6868- Updated
- 2026-11-06
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/ctfer-io/terraform-provider-ctfdGo |
0.1.5 to 1.1.0 | None known |
github.com/ctfer-io/terraform-provider-ctfd/v2Go |
before 2.8.2 | 2.8.2 |
github.com/ctfer-io/terraform-provider-ctfdGo |
0.1.5 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| facts | CVE List, EUVD, NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-116683 is a high vulnerability (CVSS 7.1) in Ctfer-io Terraform-provider-ctfd, published October 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in github.com/ctfer-io/terraform-provider-ctfd/v2 2.8.2.
References
github.com/ctfer-io/terraform-provider-ctfd/security/advisories/GHSA-vg84-c5mg-76xh
nvd.nist.gov/vuln/detail/CVE-2026-116683