CVE-2026-116683

Name of the Vulnerable Software and Affected Versions CTFer.io's CTFd Terraform Provider versions 0.1.5 through 2.8.1

Description The ctfd team.password variable is stored as a non-sensitive value in the Terraform state. A local or remote user with access to this state can read the team password without requiring an additional decryption step.

Recommendations Update to version 2.8.2. Keep the Terraform state in safe environments with a limited set of users who can access it.