CVE-2026-116683 — CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values

Summary

The imported advisory is rated high severity. It identifies 2 affected packages; whether you are affected depends on your installed version. It is not listed in the imported CISA KEV data; that does not establish that exploitation has not occurred.

Summary by cve.new · CC BY 4.0

Original source description

Impact

CTFer.io's CTFd Terraform Provider stores ctfd_team.password as non-sensitive values (CWE-522). A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption.

Patches

Patched in v2.8.2.

Workarounds

No workaround exist, yet CTFer.io recommends you keep your state in safe environments with a limited set of users who can access it as a good practice to avoid exploitation of this vulnerability.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

github.com/ctfer-io/terraform-provider-ctfd Go

Semantic versions

From 0.1.5 through 1.1.0 (inclusive)

No fix recorded for this interval.

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.1.5"
        },
        {
          "last_affected": "1.1.0"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

github.com/ctfer-io/terraform-provider-ctfd/v2 Go

Semantic versions

Earlier releases before 2.8.2

Fixed in 2.8.2

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "2.8.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

Set up in your agent.

Investigate in your agent.

CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values