7.1
High
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
CVE-2026-116683
Impact CTFer.io's CTFd Terraform Provider stores ctfdteam.password as non-sensitive values (CWE-522). A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption. Patches Patched in v2.8.2. Workarounds No workaround exist, yet CTFer.io recommends you keep your state in safe environments with a limited set of users who can access it as a good practice to avoid exploitation of this vulnerability.
Assessment
- CVSS
- 7.1 (v4.0)
- Severity
- High
- EPSS
- 0.00379% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 27 October 2026
- Last updated
- 27 October 2026
- Affected
- go · github.com/ctfer-io/terraform-provider-ctfd, github.com/ctfer-io/terraform-provider-ctfd/v2
- Weakness
- CWE-522
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:L/SA:N
At the source
References
- https://github.com/ctfer-io/terraform-provider-ctfd/security/advisories/GHSA-vg84-c5mg-76xh
- https://github.com/ctfer-io/terraform-provider-ctfd/pull/376
- https://github.com/ctfer-io/terraform-provider-ctfd/commit/b4acaef1df23ea3ca36936fc2d8ef8d157a58e04
- https://github.com/ctfer-io/terraform-provider-ctfd/releases/tag/v2.8.2
- https://github.com/advisories/GHSA-vg84-c5mg-76xh
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-116683