CVE-2026-116683High· 7.1▾ TwilightCTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 28.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.4%
CTFer.io's CTFd Terraform Provider stores ctfd_team.password as non-sensitive values (CWE-522). A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption.
Patched in v2.8.2.
No workaround exist, yet CTFer.io recommends you keep your state in safe environments with a limited set of users who can access it as a good practice to avoid exploitation of this vulnerability.
github.com/ctfer-io/terraform-provider-ctfd >= 0.1.5, <= 1.1.0github.com/ctfer-io/terraform-provider-ctfd/v2 < 2.8.2Upgrade to a patched release:
github.com/ctfer-io/terraform-provider-ctfd/v2 2.8.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105742Low· 3.7Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem
CVE-2026-82255Medium· 6.8gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects
CVE-2026-81930Medium· 6.3Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs
CVE-2025-55190High· 8.8github.com/argoproj/argo-cd: Project API Token Exposes Repository Credentials (CVE-2025-55190)
CVE-2026-71494MediumInfracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD
CVE-2026-72794High· 8.6SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf