CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values

影響: go:github.com/ctfer-io/terraform-provider-ctfd >= 0.1.5, <= 1.1.0, go:github.com/ctfer-io/terraform-provider-ctfd/v2 < 2.8.2 → 2.8.2

CTFer.io's CTFd Terraform Provider stores ctfd_team.password as non-sensitive values (CWE-522). A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption. Patches Patched in v2.8.2. Workarounds No workaround exist, yet CTFer.io recommends you keep your state in safe environments with a limited set of users who can access it as a good practice to avoid exploitation of this vulnerability.

GitHub Advisory Database에서 읽기

2026. 10. 28. 오전 04:00, GitHub Advisory Database에서 "CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: Go, GitHub. CVE: CVE-2026-116683.