CTFd Terraform Provider CVE-2026-116683

Requires that the attacker can already read the Terraform state produced by the CTFd provider (versions 0.1.5 through before 2.8.2) for configurations that define ctfd_team resources with a password attribute - e.g. a local terraform.tfstate on a shared/compromised host, a state file committed to version control or leaked in CI logs, or a misconfigured/exposed remote backend. Because the password is stored as a non-sensitive value, no state-decryption password or additional step is needed to read it. The exploitation-limiting factors are: the attacker must have prior access to the state (PR:L, not an anonymous remote read), only team passwords are exposed, and the vendor states there is no workaround other than restricting who can access state and upgrading to 2.8.2; local-only state makes the vector effectively local rather than network.

This is a credential-exposure flaw (CWE-522) with moderate, access-gated real-world risk rather than a wormable emergency. The only CVSS vector supplied is CVSS 4.0 (7.1, AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SI:L); PR:L correctly signals that exploitation is not possible without some level of authorized access - specifically access to the Terraform state. The high confidentiality rating (VC:H) is appropriate because recovered team passwords are reusable credentials, but the AV:N rating is only meaningful where state is kept in a network-reachable backend; for purely local state the effective vector is local. No EPSS score was provided and the CVE is not on the CISA KEV list, so there is no signal of active or widespread exploitation. No SSVC exploitation/automatable fields were supplied beyond the vuln.today priority of 'this_week', which, combined with an available vendor patch and the lack of KEV/EPSS, is consistent with a prompt-but-not-emergency remediation. The key missing data points are EPSS and any independent exploitation telemetry; the key limiting factor - prior access to Terraform state - is confirmed by the vendor advisory and is the dominant risk modifier here.

An attacker who can read a team's Terraform state (for example a CI job with state access, a state file accidentally committed to a repository, or an exposed/misconfigured remote backend such as an S3 bucket) opens the state and reads the ctfd_team.password value directly, because it is stored as a non-sensitive attribute requiring no decryption. They then reuse that plaintext password to log into CTFd as the affected team. No public working exploit is needed, since the value is plainly readable in the state file.