---
id: CVE-2026-116683
aliases:
  - GHSA-vg84-c5mg-76xh
title: >-
  CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read
  team passwords in state as non sensitive values
summary: >-
  CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read
  team passwords in state as non sensitive values
severity: high
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:L/SA:N'
vendor: ctfer-io
product: github.com/ctfer-io/terraform-provider-ctfd
ecosystem: go
affected:
  - 'github.com/ctfer-io/terraform-provider-ctfd >= 0.1.5, <= 1.1.0'
  - github.com/ctfer-io/terraform-provider-ctfd/v2 < 2.8.2
patched:
  - github.com/ctfer-io/terraform-provider-ctfd/v2 2.8.2
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T19:15:22.403621877Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-vg84-c5mg-76xh'
references:
  - url: >-
      https://github.com/ctfer-io/terraform-provider-ctfd/security/advisories/GHSA-vg84-c5mg-76xh
  - url: 'https://github.com/ctfer-io/terraform-provider-ctfd/pull/376'
  - url: >-
      https://github.com/ctfer-io/terraform-provider-ctfd/commit/b4acaef1df23ea3ca36936fc2d8ef8d157a58e04
  - url: 'https://github.com/ctfer-io/terraform-provider-ctfd'
  - url: 'https://github.com/ctfer-io/terraform-provider-ctfd/releases/tag/v2.8.2'
  - url: 'https://github.com/advisories/GHSA-vg84-c5mg-76xh'
tags:
  - osv
  - go
  - ghsa
  - cve.org
epss: 0.00379
epssPercentile: 0.31837
cvssSource: cna
cwe:
  - CWE-522
ingestedAt: '2026-10-27T18:52:10.022Z'
---

## Overview

### Impact

CTFer.io's CTFd Terraform Provider stores `ctfd_team.password` as non-sensitive values (CWE-522). A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption.

### Patches

Patched in v2.8.2.

### Workarounds

No workaround exist, yet CTFer.io recommends you keep your state in safe environments with a limited set of users who can access it as a good practice to avoid exploitation of this vulnerability.

## Affected packages

- `github.com/ctfer-io/terraform-provider-ctfd >= 0.1.5, <= 1.1.0`
- `github.com/ctfer-io/terraform-provider-ctfd/v2 < 2.8.2`

## Remediation

Upgrade to a patched release:

- `github.com/ctfer-io/terraform-provider-ctfd/v2 2.8.2`