CVE-2026-116683: CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
Impact
CTFer.io's CTFd Terraform Provider stores ctfdteam.password as non-sensitive values (CWE-522). A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption.
Patches
Patched in v2.8.2.
Workarounds
No workaround exist, yet CTFer.io recommends you keep your state in safe environments with a limited set of users who can access it as a good practice to avoid exploitation of this vulnerability.
Other sources
CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfdteam.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/ctfer-io/terraform-provider-ctfd/v2to a version that resolves this vulnerability.Fixed in 2.8.2 - Upgrade
Upgrade
CTFer.io's CTFd Terraform Providerto a version that resolves this vulnerability.Fixed in 2.8.2 - Compensating control
Keep the Terraform state in safe environments with access limited to users who require it.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any local or remote user who can access the Terraform state containing a ctfd_team resource can read that team's password. No additional decryption step is required.
Which provider versions are affected?
The issue affects versions from 0.1.5 until 2.8.2. Version 2.8.2 fixes the issue.
How can I determine whether passwords may already be exposed?
Review access to Terraform state created with affected provider versions and check whether it contains ctfd_team resources. Team passwords in that state may be readable to anyone with state access.