CVE-2026-116683 — Vulnerability intelligence
—
Published:
- CVSS
- 7.1
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.