{"id":"CVE-2026-116683","kind":"vulnerability","aliases":["CVE-2026-116683","GHSA-vg84-c5mg-76xh"],"related":[],"title":"CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values","description":"### Impact\n\nCTFer.io's CTFd Terraform Provider stores `ctfd_team.password` as non-sensitive values (CWE-522). A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption.\n\n### Patches\n\nPatched in v2.8.2.\n\n### Workarounds\n\nNo workaround exist, yet CTFer.io recommends you keep your state in safe environments with a limited set of users who can access it as a good practice to avoid exploitation of this vulnerability.","summary":"The CTFd Terraform provider records each ctfd_team password as a non-sensitive attribute, so it is written in plain text into the Terraform state file. Anyone who can read that state can take the team passwords without decrypting anything.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/ctfer-io/terraform-provider-ctfd","fixed":[],"affected":">= 0.1.5, <= 1.1.0","ecosystem":"go"},{"name":"github.com/ctfer-io/terraform-provider-ctfd/v2","fixed":["2.8.2"],"affected":"< 2.8.2","ecosystem":"go"}],"ecosystems":["go"],"tags":["ctf-platforms","ctfd","cwe-522","package","self-hosted","terraform"],"not_affected_if":["no-ctfd-team-resource","state-access-restricted"],"how_to_check":"- Run `grep -i password terraform.tfstate` (or inspect the remote state backend) and look for `ctfd_team` entries holding a readable password value\n- Check the provider version in `.terraform.lock.hcl` or `terraform providers` against `2.8.2`; the Go module `github.com/ctfer-io/terraform-provider-ctfd/v2` below `2.8.2` is affected","fix":"- Upgrade the provider `github.com/ctfer-io/terraform-provider-ctfd/v2` to `2.8.2` or later\n- Rotate the passwords of existing CTFd teams, since old state versions still hold them\n- Restrict read access to the Terraform state and its backend to a small set of users","status":"open","published_at":"2026-10-27T19:00:50+00:00","first_seen_at":"2026-10-27T19:04:56+00:00","triaged_at":"2026-10-27T19:06:00+00:00","updated_at":"2026-10-27T19:33:18+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T19:06:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the provider `github.com/ctfer-io/terraform-provider-ctfd/v2` to `2.8.2` or later\n- Rotate the passwords of existing CTFd teams, since old state versions still hold them\n- Restrict read access to the Terraform state and its backend to a small set of users","reach":"unknown","title":"CTFd Terraform Provider: team passwords stored unmasked in Terraform state","impact":"medium","summary":"The CTFd Terraform provider records each ctfd_team password as a non-sensitive attribute, so it is written in plain text into the Terraform state file. Anyone who can read that state can take the team passwords without decrypting anything.","category":"package","nicknames":[],"who_cares":["terraform","ctfd","self-hosted","ctf-platforms"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Team login passwords readable from Terraform state files","analyst_note":"","how_to_check":"- Run `grep -i password terraform.tfstate` (or inspect the remote state backend) and look for `ctfd_team` entries holding a readable password value\n- Check the provider version in `.terraform.lock.hcl` or `terraform providers` against `2.8.2`; the Go module `github.com/ctfer-io/terraform-provider-ctfd/v2` below `2.8.2` is affected","needs_analyst":false,"not_affected_if":["no-ctfd-team-resource","state-access-restricted"],"who_is_affected":"Teams that manage CTFd teams with this Terraform provider and store state anywhere others can read it, such as shared buckets, CI artifacts or local machines. Teams that do not use this provider, or that have no users able to read their state, face much less exposure.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000666,"input_tokens":3505,"output_tokens":631,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116683':24A,32A '-2026':23A,31A '-522':44B,105C '/ctfer-io/terraform-provider-ctfd':35A '/ctfer-io/terraform-provider-ctfd/v2':38A '76xh':29A 'access':114C,158C 'allow':6A 'anyon':77B 'anyth':90B 'attack':11A,110C 'attribut':64B 'avoid':165C 'c5mg':28A 'ctf':40B 'ctf-platform':39B 'ctfd':3A,42B,51B,56B,94C 'ctfd_team.password':98C 'ctfer.io':1A,92C,141C 'cve':22A,30A 'cwe':43B,104C 'decrypt':89B,131C 'environ':149C 'exist':139C 'exploit':166C 'file':76B 'ghsa':26A 'ghsa-vg84-c5mg-76xh':25A 'github.com':34A,37A 'github.com/ctfer-io/terraform-provider-ctfd':33A 'github.com/ctfer-io/terraform-provider-ctfd/v2':36A 'good':162C 'host':48B 'impact':91C 'keep':144C 'limit':152C 'local':8A,107C 'need':125C 'non':19A,62B,101C 'non-sensit':61B,100C 'packag':45B 'password':15A,58B,87B,122C,129C 'patch':132C,133C 'plain':70B 'platform':41B 'practic':163C 'provid':5A,53B,96C 'read':13A,80B,120C 'recommend':142C 'record':54B 'remot':10A,109C 'safe':148C 'self':47B 'self-host':46B 'sensit':20A,63B,102C 'set':153C 'state':17A,75B,82B,118C,128C,146C 'store':97C 'take':84B 'team':14A,57B,86B,121C 'terraform':4A,49B,52B,74B,95C,117C 'text':71B 'user':155C 'v2.8.2':135C 'valu':21A,103C 'vg84':27A 'vulner':169C 'without':88B,123C 'workaround':136C,138C 'written':68B 'yet':140C","nicknames":[],"mitigations":[],"who_affected":"Teams that manage CTFd teams with this Terraform provider and store state anywhere others can read it, such as shared buckets, CI artifacts or local machines. Teams that do not use this provider, or that have no users able to read their state, face much less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T19:00:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-vg84-c5mg-76xh","url":"https://github.com/advisories/GHSA-vg84-c5mg-76xh","severity":"high","published_at":"2026-10-27T19:00:50+00:00","modified_at":"2026-10-27T19:00:51+00:00","first_seen_at":"2026-10-27T19:04:56+00:00","fetched_at":"2026-10-27T19:04:56+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-116683","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116683","severity":null,"published_at":"2026-10-27T19:17:11+00:00","modified_at":"2026-10-27T19:17:11+00:00","first_seen_at":"2026-10-27T19:33:18+00:00","fetched_at":"2026-10-27T19:33:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}