Live › vulnerability › CVE-2026-116683
Go to dashboardThe CTFd Terraform provider records each ctfd_team password as a non-sensitive attribute, so it is written in plain text into the Terraform state file. Anyone who can read that state can take the team passwords without decrypting anything.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 19:04 UTC, 0h before NVD. All times on this page are UTC.
Teams that manage CTFd teams with this Terraform provider and store state anywhere others can read it, such as shared buckets, CI artifacts or local machines. Teams that do not use this provider, or that have no users able to read their state, face much less exposure.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/ctfer-io/terraform-provider-ctfd | go | >= 0.1.5, <= 1.1.0 | – |
| github.com/ctfer-io/terraform-provider-ctfd/v2 | go | < 2.8.2 | 2.8.2 |
grep -i password terraform.tfstate (or inspect the remote state backend) and look for ctfd_team entries holding a readable password value.terraform.lock.hcl or terraform providers against 2.8.2; the Go module github.com/ctfer-io/terraform-provider-ctfd/v2 below 2.8.2 is affectedgithub.com/ctfer-io/terraform-provider-ctfd/v2 to 2.8.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CTFer.io's CTFd Terraform Provider stores ctfd_team.password as non-sensitive values (CWE-522). A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption.
Patched in v2.8.2.
No workaround exist, yet CTFer.io recommends you keep your state in safe environments with a limited set of users who can access it as a good practice to avoid exploitation of this vulnerability.
This page as .md · .json · in your agent: get_signal("CVE-2026-116683")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.