GHSA-vg84-c5mg-76xh

Source

https://github.com/advisories/GHSA-vg84-c5mg-76xh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-vg84-c5mg-76xh/GHSA-vg84-c5mg-76xh.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vg84-c5mg-76xh

Aliases

CVE-2026-116683

Published

2026-10-27T19:00:50Z

Modified

2026-10-27T19:15:22Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:L/SA:N CVSS Calculator

Summary

CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values

Details

Impact

CTFer.io's CTFd Terraform Provider stores ctfd_team.password as non-sensitive values (CWE-522). A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption.

Patches

Patched in v2.8.2.

Workarounds

No workaround exist, yet CTFer.io recommends you keep your state in safe environments with a limited set of users who can access it as a good practice to avoid exploitation of this vulnerability.

Database specific

{
    "cwe_ids":  [
        "CWE-522"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-27T19:00:50Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

Go / github.com/ctfer-io/terraform-provider-ctfd

Package

Name: github.com/ctfer-io/terraform-provider-ctfd; View open source insights on deps.dev
Purl: pkg:golang/github.com/ctfer-io/terraform-provider-ctfd

Affected ranges

Type: SEMVER
Events: Introduced

0.1.5

Last Affected

1.1.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-vg84-c5mg-76xh/GHSA-vg84-c5mg-76xh.json"

Go / github.com/ctfer-io/terraform-provider-ctfd/v2

Package

Name: github.com/ctfer-io/terraform-provider-ctfd/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/ctfer-io/terraform-provider-ctfd/v2

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.8.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-vg84-c5mg-76xh/GHSA-vg84-c5mg-76xh.json"