PT-2026-127757

Impact CTFer.io's CTFd Terraform Provider stores ctfd team.password as non-sensitive values CWE-522. A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption. Patches Patched in v2.8.2. Workarounds No...

PT-2026-127198

Name of the Vulnerable Software and Affected Versions CTFer.io's CTFd Terraform Provider versions 0.1.5 through 2.8.1 Description The ctfd team.password variable is stored as a non-sensitive value in the Terraform state. A local or remote user with access to this state can read the team password...