Terraform-Provider-Ctfd (0.1.5-1.1.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/terraform-provider-ctfd-0.1.5-1.1.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 23:59:06 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCTFer.io CTFd Terraform Provider: Sensitive credential exposure in state (CVE-2026-116683)https://feed.craftedsignal.io/briefs/2026-10-ctfd-terraform-provider-cred-exposure/Tue, 27 Oct 2026 23:59:06 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-ctfd-terraform-provider-cred-exposure/The CTFer.io CTFd Terraform Provider fails to mark team passwords as sensitive, resulting in plain-text storage of credentials within Terraform state files (CVE-2026-116683).The CTFer.io Terraform Provider for CTFd contains a vulnerability where the ctfd_team.password attribute is not marked as sensitive within the Terraform resource schema. This configuration causes Terraform to store these passwords in plain text within the state file (CWE-522). Any entity with read access to the state file can retrieve these credentials without requiring the state's encryption key. This affects version ranges 0.1.5 through 1.1.0 for the main provider and all versions prior to 2.8.2 for the v2 provider.

Impact

Successful exploitation allows unauthorized access to team credentials stored in CTFd. Because Terraform state is often stored in version control systems or remote backends, exposure of these files could lead to widespread credential compromise.

Recommendation

  • Upgrade to terraform-provider-ctfd version 2.8.2 or later immediately.
  • Audit existing Terraform state files for the ctfd_team resource and redact any plain-text passwords found.
  • Enforce strict access control on Terraform state storage backends (e.g., S3 buckets, Terraform Cloud) to prevent unauthorized read access by users or automated processes.
]]>highadvisory