GHSA-vg84-c5mg-76xh: Go/github.com/ctfer-io/terraform-provider-ctfd/v2 vulnerability

Q: Who can exploit this issue?

Any local or remote attacker who can access the Terraform state can read CTFd team passwords. They do not need the state password to decrypt those values.

Q: Which provider versions are fixed?

The issue is patched in CTFer.io's CTFd Terraform Provider version 2.8.2.

Q: What should be done if upgrading is not immediately possible?

No workaround is available. Keep Terraform state only in safe environments and limit access to a small set of authorized users.

Q: How can I determine whether credentials may be exposed?

Review who has access to Terraform state associated with ctfd_team resources, including both local and remote state locations. Anyone with that access may be able to read team passwords from affected state.

Published Oct 27, 2026

Updated

Impact

CTFer.io's CTFd Terraform Provider stores ctfdteam.password as non-sensitive values (CWE-522). A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption.

Patches

Patched in v2.8.2.

Workarounds

No workaround exist, yet CTFer.io recommends you keep your state in safe environments with a limited set of users who can access it as a good practice to avoid exploitation of this vulnerability.

Affected Software

2 affected componentsFixes available

go/github.com/ctfer-io/terraform-provider-ctfd/v2<2.8.2

2.8.2

go/github.com/ctfer-io/terraform-provider-ctfd>=0.1.5<=1.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade go/github.com/ctfer-io/terraform-provider-ctfd/v2 to a version that resolves this vulnerability.
Fixed in 2.8.2
Upgrade
Upgrade CTFer.io CTFd Terraform Provider to a version that resolves this vulnerability.
Fixed in v2.8.2
Compensating control
Keep the Terraform state in a safe environment with access limited to a set of authorized users.

Event History

Oct 27, 2026

Advisory Published

via GitHub·07:00 PM

Data Sourced

via GitHub·07:00 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Who can exploit this issue?

Any local or remote attacker who can access the Terraform state can read CTFd team passwords. They do not need the state password to decrypt those values.

Which provider versions are fixed?

The issue is patched in CTFer.io's CTFd Terraform Provider version 2.8.2.

What should be done if upgrading is not immediately possible?

No workaround is available. Keep Terraform state only in safe environments and limit access to a small set of authorized users.

How can I determine whether credentials may be exposed?

Review who has access to Terraform state associated with ctfd_team resources, including both local and remote state locations. Anyone with that access may be able to read team passwords from affected state.

GHSA-vg84-c5mg-76xh: Go/github.com/ctfer-io/terraform-provider-ctfd/v2 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which provider versions are fixed?

What should be done if upgrading is not immediately possible?

How can I determine whether credentials may be exposed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which provider versions are fixed?

What should be done if upgrading is not immediately possible?

How can I determine whether credentials may be exposed?