PatchSiren

ctfer-io CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH ctfer-io CVE published 2026-10-27

CVE-2026-116683

A vulnerability in CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords stored as non-sensitive values in Terraform state. The issue is patched in version 2.8.2. Users should update to the latest version and ensure Terraform state is stored securely with limited access controls and monitoring to prevent unauthorized access. This involves reviewing current Terraform s [truncated]