---
id: "CVE-2026-116683"
kind: "vulnerability"
aliases: ["CVE-2026-116683", "GHSA-vg84-c5mg-76xh"]
title: "CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/ctfer-io/terraform-provider-ctfd", "fixed": [], "affected": ">= 0.1.5, <= 1.1.0", "ecosystem": "go"}, {"name": "github.com/ctfer-io/terraform-provider-ctfd/v2", "fixed": ["2.8.2"], "affected": "< 2.8.2", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["ctf-platforms", "ctfd", "cwe-522", "package", "self-hosted", "terraform"]
not_affected_if: ["no-ctfd-team-resource", "state-access-restricted"]
published_at: "2026-10-27T19:00:50+00:00"
first_seen_at: "2026-10-27T19:04:56+00:00"
updated_at: "2026-10-27T19:33:18+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-vg84-c5mg-76xh", "first_seen_at": "2026-10-27T19:04:56+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116683", "first_seen_at": "2026-10-27T19:33:18+00:00"}]
---

# CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values

The CTFd Terraform provider records each ctfd_team password as a non-sensitive attribute, so it is written in plain text into the Terraform state file. Anyone who can read that state can take the team passwords without decrypting anything.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/ctfer-io/terraform-provider-ctfd affected >= 0.1.5, <= 1.1.0 fixed ?
- go:github.com/ctfer-io/terraform-provider-ctfd/v2 affected < 2.8.2 fixed 2.8.2

## How to check

- Run `grep -i password terraform.tfstate` (or inspect the remote state backend) and look for `ctfd_team` entries holding a readable password value
- Check the provider version in `.terraform.lock.hcl` or `terraform providers` against `2.8.2`; the Go module `github.com/ctfer-io/terraform-provider-ctfd/v2` below `2.8.2` is affected

## Fix

- Upgrade the provider `github.com/ctfer-io/terraform-provider-ctfd/v2` to `2.8.2` or later
- Rotate the passwords of existing CTFd teams, since old state versions still hold them
- Restrict read access to the Terraform state and its backend to a small set of users

## Timeline

- 2026-10-27T19:04:56+00:00 ghsa https://github.com/advisories/GHSA-vg84-c5mg-76xh
- 2026-10-27T19:33:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116683

## From the sources

### Impact

CTFer.io's CTFd Terraform Provider stores `ctfd_team.password` as non-sensitive values (CWE-522). A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption.

### Patches

Patched in v2.8.2.

### Workarounds

No workaround exist, yet CTFer.io recommends you keep your state in safe environments with a limited set of users who can access it as a good practice to avoid exploitation of this vulnerability.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_