Terraform
CVE-2026-27900
MEDIUM
GHSA-5rc7-2jj6-mp64
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A09:2025 - Security Logging & Alerting Failures
ASVS 5.0
V16 - Security Logging and Error Handling Log data sanitization
|
| Impact | CVSS 5.0 (MEDIUM). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Exploitation requires authentication. Exploitable via local access. |
| Exploit ScenarioDerived | An attacker (requires authentication) could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
The Terraform Provider for Linode prior to version 3.9.0 exposes sensitive credentials including passwords and API tokens in debug logs when debug logging is explicitly enabled. Authenticated attackers with access to these logs through CI/CD pipelines, log aggregation systems, or shared debug output can extract exposed secrets. This vulnerability requires an authenticated user and debug logging activation, making it exploitable primarily in environments where logging is intentionally enabled for troubleshooting.
Earlier versions of this analysis (1)
The Terraform Provider for Linode versions prior to v3.9.0 logged sensitive information including some passwords, StackScript content, and object storage data in debug logs without redaction. Provider debug logging is not enabled by default. [CVSS 5.0 MEDIUM]
RemediationAI
A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-532 (Insertion of Sensitive Information into Log File). Affects Linode Provider. The Terraform Provider for Linode versions prior to v3.9.0 logged sensitive information including some passwords, StackScript content, and object storage data in debug logs without redaction. Provider debug logging is not enabled by default. This issue is exposed when debug/provider logs are explicitly enabled (for example in local troubleshooting, CI/CD jobs, or centralized log collection). If enabled, sensitive values may be written to logs and then retained, shared, or exported beyond the ori
Know when Terraform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
The Terraform Provider for Linode versions prior to v3.9.0 logged sensitive information including some passwords, StackScript content, and object storage data in debug logs without redaction. Provider debug logging is not enabled by default. This issue is exposed when debug/provider logs are explicitly enabled (for example in local troubleshooting, CI/CD jobs, or centralized log collection). If enabled, sensitive values may be written to logs and then retained, shared, or exported beyond the original execution environment. An authenticated user with access to provider debug logs (through log aggregation systems, CI/CD pipelines, or debug output) would thus be able to extract these sensitive credentials. Versions 3.9.0 and later sanitize debug logs by logging only non-sensitive metadata such as labels, regions, and resource IDs while redacting credentials, tokens, keys, scripts, and other sensitive content. Some other mitigations and workarounds are available. Disable Terraform/provider debug logging or set it to WARN level or above, restrict access to existing and historical logs, purge/retention-trim logs that may contain sensitive values, and/or rotate potentially exposed secrets/credentials.
Executive ViewAI
CVE-2026-27900 presents moderate security risk, a log file exposure vulnerability rated CVSS 5.0. This could allow unauthorized file access. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: restrict endpoint access, redact sensitive data in logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)GitHub Advisory
Improper validation of parameters in GitLab CE/EE's Terraform state upload functionality allows an authenticated user ho
aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0
HashiCorp Terraform Enterprise releases up to v202106-1 did not properly perform authorization checks on a subset of API
Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the `init` operation if run on maliciously craf
When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the
Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise w
Exploit-DB