What is the CVSS score of CVE-2026-27640?

CVE-2026-27640 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Azure are affected by CVE-2026-27640?

CVE-2026-27640 affects tfplan2md, a tool used to convert Terraform infrastructure-as-code plans into readable reports.

How to fix or mitigate CVE-2026-27640?

Within 24 hours: Identify all systems running tfplan2md and assess whether they process sensitive infrastructure plans; isolate or restrict access to affected instances. Within 7 days: Implement compensating controls (network segmentation, input validation, access restrictions); consider disabling tfplan2md if not business-critical. Within 30 days: Monitor vendor advisories for patch availability; evaluate alternative tools or hardened configurations; conduct audit of past plan exports for unauthorized access.

Azure CVE-2026-27640

HIGH

Improper Removal of Sensitive Information Before Storage or Transfer (CWE-212)

2026-02-25 security-advisories@github.com

Azure Tfplan2md

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 25, 2026 - 04:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

tfplan2md is software for converting Terraform plan JSON files into human-readable Markdown reports. Prior to version 1.26.1, a bug in tfplan2md affected several distinct rendering paths: AzApi resource body properties, AzureDevOps variable groups, Scriban template context variables, and hierarchical sensitivity detection. This caused reports to render values that should have been masked as "(sensitive)" instead. This issue is fixed in v1.26.1. No known workarounds are available.

AnalysisAI

tfplan2md versions before 1.26.1 fail to properly mask sensitive values in Terraform plan reports across multiple rendering paths, causing credentials and other confidential data to be exposed in plaintext markdown output instead of being redacted. Administrators and developers using affected versions to generate infrastructure reports may inadvertently expose secrets to unauthorized parties with access to the generated documentation. No patch is currently available for this high-severity information disclosure vulnerability affecting Azure and Terraform workflows.

Technical ContextAI

Affects Tfplan2Md. tfplan2md is software for converting Terraform plan JSON files into human-readable Markdown reports. Prior to version 1.26.1, a bug in tfplan2md affected several distinct rendering paths: AzApi resource body properties, AzureDevOps variable groups, Scriban template context variables, and hierarchical sensitivity detection. This caused reports to render values that should have been masked as "(sensitive)" instead. This issue is fixed in v1.26.1. No known workarounds are available.