CVE-2026-116683 ctfer-io CVE debrief

Who should care

Defenders responsible for Terraform infrastructure and security should assess exposure and prioritize updates to version 2.8.2 or later. They should review Terraform state storage security, limit access to Terraform state, and verify the security of Terraform state storage and access limitations. This includes operators managing Terraform infrastructure, security teams responsible for vulnerability management, and platform administrators who need to ensure

Why it matters

The vulnerability allows a local or remote attacker to read team passwords stored in Terraform state without the need for the state password. Defenders should prioritize updating to version 2.8.2 or later, review Terraform state storage security, and limit access to Terraform state.

• Team password exposure through Terraform state access
• Potential unauthorized access to sensitive team information
• Need for secure Terraform state storage and access controls
• Verification of Terraform state security and access limitations

Technical summary

CTFer.io's CTFd Terraform Provider stores `ctfd_team.password` as non-sensitive values. A local or remote attacker with access to Terraform state can read team passwords without the state password for decryption. This issue relates to CWE-522 and highlights the need for secure Terraform state storage and access controls to prevent team password exposure. The vulnerability is patched in version 2.8.2, and users should update to this version or later to mitigate the issue. Additionally, defenders should review Terraform state storage security and limit access to Terraform state.

Defensive priority

Defenders should prioritize updating to version 2.8.2 or later and review Terraform state storage security.

Recommended defensive actions

• Update to version 2.8.2 or later
• Review Terraform state storage security
• Limit access to Terraform state
• Monitor for unauthorized access to Terraform state
• Verify security of Terraform state storage and access limitations
• Assess exposure and prioritize updates
• Implement compensating controls for exposed systems

Evidence notes

The vulnerability is described in the CVE record and source item from osv_dev. The issue is related to CWE-522 and has a CVSS score. The affected package is github.com/ctfer-io/terraform-provider-ctfd.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.