CVE-2026-27640
📋 TL;DR
tfplan2md versions before 1.26.1 fail to properly mask sensitive values in Terraform plan reports, exposing secrets like API keys, passwords, and configuration data. This affects anyone using tfplan2md to generate reports from Terraform plans containing sensitive data. The vulnerability occurs in multiple rendering paths including AzApi resources and AzureDevOps variable groups.
💻 Affected Systems
- tfplan2md
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Sensitive infrastructure secrets (database passwords, API keys, cloud credentials) are exposed in reports, potentially leading to full infrastructure compromise if reports are shared or stored insecurely.
Likely Case
Accidental exposure of sensitive configuration values in reports shared with team members or stored in version control, potentially violating security policies and compliance requirements.
If Mitigated
Limited exposure if reports are properly secured with strict access controls and not shared beyond authorized personnel.
🎯 Exploit Status
No active exploitation reported. The vulnerability is triggered during normal report generation when processing sensitive data.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.26.1
Vendor Advisory: https://github.com/oocx/tfplan2md/security/advisories/GHSA-5j8r-g94q-2f39
Restart Required: No
Instructions:
1. Update tfplan2md to version 1.26.1 or later using your package manager. 2. For Go installations: go get github.com/oocx/tfplan2md@v1.26.1. 3. Verify the update with tfplan2md --version.
🔧 Temporary Workarounds
Manual report sanitization
allManually review and redact sensitive values from generated reports before sharing
🧯 If You Can't Patch
- Restrict access to generated reports to only authorized personnel
- Audit all previously generated reports for exposed sensitive data and secure/delete them
🔍 How to Verify
Check if Vulnerable:
Check tfplan2md version with 'tfplan2md --version'. If version is below 1.26.1, you are vulnerable.Check Version:
tfplan2md --versionVerify Fix Applied:
After updating, generate a test report with sensitive data and verify sensitive values are masked as '(sensitive)'.📡 Detection & Monitoring
Log Indicators:
- Unusual report generation patterns
- Reports containing unmasked sensitive values
SIEM Query:
Search for file creation/modification events containing tfplan2md output files with potential sensitive data patterns.