Zero Radar
← feed
HighVulnerabilityCVE-2026-116683updated 27 Oct 2026, 19:21 UTC

Terraform provider for CTFd stores team passwords in readable state

Team passwords are saved in plain readable form in Terraform's state file. Anyone who can read that file can see the passwords directly, without needing any extra key.

Partial fixOfficial, 2 sources
SeverityHighCVSS 7.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Partlygo/github.com/ctfer-io/terraform-provider-ctfd/v2 2.8.2 · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Team password setPassword defined in Terraform config
  2. 2State writtenPassword saved as non-sensitive value
  3. 3State accessedLocal or remote user reads the file
  4. 4Password readableNo decryption step needed
  5. ResultAttacker reads team passwords in plain text

What happened

The CTFd Terraform Provider marks ctfd_team.password as non-sensitive, so it is written unencrypted into Terraform state (CWE-522, insufficiently protected credentials).

Why it is dangerous: Anyone who gets access to the Terraform state, locally or remotely, can read CTFd team passwords and log in as those teams. Competition organizers and their CI/state storage are most exposed.

Are you affected?

You are affected if you use the ctfer-io/terraform-provider-ctfd module (v0.1.5 through 1.1.0, or the v2 module below 2.8.2) and manage ctfd_team resources with password values stored in Terraform state.

Package / productAffected versionsFixed in
github.com/ctfer-io/terraform-provider-ctfd · go>= 0.1.5, <= 1.1.0no fix yet
github.com/ctfer-io/terraform-provider-ctfd/v2 · go< 2.8.22.8.2

What to do

  1. Upgrade the v2 provider to version 2.8.2 or later
  2. Check whether you are on the v1 module (0.1.5 to 1.1.0); no fixed v1 release is stated, so plan a move to v2
  3. Restrict who can read Terraform state files and keep state in secure storage
  4. Rotate any team passwords that were stored in state while the vulnerable version was in use

Timeline

  1. 27 Oct 2026, 19:00 UTC
    Publicly disclosed
  2. 27 Oct 2026, 19:00 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 27 Oct 2026, 19:00 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 19:21 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116683 · GHSA-vg84-c5mg-76xh
CVSS
7.1 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 19:00 UTC
On Zero Radar
27 Oct 2026, 19:00 UTC (0 min after disclosure)
Last change
27 Oct 2026, 19:21 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Terraform provider for CTFd stores team passwords in readable state · Zero Radar