https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-05T09:47:33.852728+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-116683 fkie_cve-2026-116683 2026-11-05T09:47:33.854854+00:00

CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.

 https://db.gcve.eu/vuln/ghsa-vg84-c5mg-76xh GHSA-vg84-c5mg-76xh — CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive v… 2026-11-05T09:47:33.854922+00:00

Affected: Go: github.com/ctfer-io/terraform-provider-ctfd, Go: github.com/ctfer-io/terraform-provider-ctfd/v2

### Impact

CTFer.io's CTFd Terraform Provider stores `ctfd_team.password` as non-sensitive values (CWE-522). A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption.

### Patches

Patched in v2.8.2.

### Workarounds

No workaround exist, yet CTFer.io recommends you keep your state in safe environments with a limited set of users who can access it as a good practice to avoid exploitation of this vulnerability.