Vulnerability GHSA-vg84-c5mg-76xh
High Risk
HIGH RISK
CVSS Score: 8.0
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
9 days ago
October 27, 2026 at 07:00 PM UTC
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
>=0.1.5 <=1.1.0
>=0.1.5 <=1.1.0
Summary
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
Details
Impact
CTFer.io's CTFd Terraform Provider stores ctfd_team.password as non-sensitive values (CWE-522). A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption.
Patches
Patched in v2.8.2.
Workarounds
No workaround exist, yet CTFer.io recommends you keep your state in safe environments with a limited set of users who can access it as a good practice to avoid exploitation of this vulnerability.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
9 hours ago
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values in github.com/ctfer-io/terraform-provider-ctfd
>=0.1.5 GO-2026-6868
>=0.1.5 GO-2026-6868
Unknown
9 hours ago
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values in github.com/ctfer-io/terraform-provider-ctfd
<2.8.2 GO-2026-6868
<2.8.2 GO-2026-6868
Impacted packages
Timeline
Published
9 days ago
October 27, 2026 at 07:00 PM UTC
Fixed (v2.8.2)
1 month ago
September 17, 2026 at 08:43 AM UTC
Last Modified
8 hours ago
November 05, 2026 at 11:26 PM UTC