VulnSocial

CVE-2026-116683

LOWCVSS 7.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-522

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-27: 110-27
Referenced assets1 URL
Full discourse1 post
  • DailyCVE@dailycve

    🔴 CTFd Terraform Provider, Plaintext Team Password Storage in State, #CVE-2026-116683 (High) Just Updated -DC-Oct2026-3845 https://dailycve.com/ctfd-terraform-provider-plaintext-team-password-storage-in-state-cve-2026-116683-high-just-updated-dc-oct2026-3845/

    0000029
    247 followersView on X

Explore more

Back to dashboard