CVE-2026-116683 CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-116683?
CVE-2026-116683 is a high-severity vulnerability in ctfer-io terraform-provider-ctfd, published on 27 Oct 2026.
Official description
CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.
Weakness: CWE-522
Which versions are affected by CVE-2026-116683?
4 open source packages ship an affected version, including github.com/ctfer-io/terraform-provider-ctfd and github.com/ctfer-io/terraform-provider-ctfd/v2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ctfer-io/terraform-provider-ctfd Go | From 0.1.5 to 1.1.0 | None |
github.com/ctfer-io/terraform-provider-ctfd Go | From 0.1.5 to 1.1.0 | None |
github.com/ctfer-io/terraform-provider-ctfd/v2 Go | All versions | 2.8.2 |
github.com/ctfer-io/terraform-provider-ctfd/v2 Go | All versions | 2.8.2 |
How do I fix CVE-2026-116683?
Upgrade to a fixed version.
Is CVE-2026-116683 being exploited?
There is no known exploitation of CVE-2026-116683 in the wild and no public exploit code.
Sources
Also known as GHSA-vg84-c5mg-76xh.