{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/ctfer.io/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ctfer.io:terraform-provider-ctfd:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-116683"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["terraform-provider-ctfd (0.1.5-1.1.0)","terraform-provider-ctfd/v2 (\u003c 2.8.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["CTFer.io"],"content_html":"\u003cp\u003eThe CTFer.io Terraform Provider for CTFd contains a vulnerability where the \u003ccode\u003ectfd_team.password\u003c/code\u003e attribute is not marked as sensitive within the Terraform resource schema. This configuration causes Terraform to store these passwords in plain text within the state file (CWE-522). Any entity with read access to the state file can retrieve these credentials without requiring the state's encryption key. This affects version ranges 0.1.5 through 1.1.0 for the main provider and all versions prior to 2.8.2 for the v2 provider.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized access to team credentials stored in CTFd. Because Terraform state is often stored in version control systems or remote backends, exposure of these files could lead to widespread credential compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to terraform-provider-ctfd version 2.8.2 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit existing Terraform state files for the \u003ccode\u003ectfd_team\u003c/code\u003e resource and redact any plain-text passwords found.\u003c/li\u003e\n\u003cli\u003eEnforce strict access control on Terraform state storage backends (e.g., S3 buckets, Terraform Cloud) to prevent unauthorized read access by users or automated processes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T23:59:06Z","date_published":"2026-10-27T23:59:06Z","id":"https://feed.craftedsignal.io/briefs/2026-10-ctfd-terraform-provider-cred-exposure/","summary":"The CTFer.io CTFd Terraform Provider fails to mark team passwords as sensitive, resulting in plain-text storage of credentials within Terraform state files (CVE-2026-116683).","title":"CTFer.io CTFd Terraform Provider: Sensitive credential exposure in state (CVE-2026-116683)","url":"https://feed.craftedsignal.io/briefs/2026-10-ctfd-terraform-provider-cred-exposure/"}],"language":"en","title":"CraftedSignal Threat Feed - CTFer.io","version":"https://jsonfeed.org/version/1.1"}