PT-2026-21856 · Tfplan2Md · Tfplan2Md

Oocx · Publicado 2026-02-25 · Atualizado 2026-03-04 · CVE-2026-27640

Positive Technologies (AI Summary)

CVSS v4.0

8.5

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions tfplan2md versions prior to 1.26.1

Description tfplan2md is software used to convert Terraform plan JSON files into Markdown reports. Versions of the software prior to 1.26.1 had a flaw where sensitive values that should have been masked as "(sensitive)" were instead rendered in plain text in several rendering paths: AzApi resource body properties, AzureDevOps variable groups, Scriban template context variables, and hierarchical sensitivity detection. This resulted in potential exposure of sensitive data.

Recommendations Update to version 1.26.1 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-212

Identificadores relacionados

CVE-2026-27640

GHSA-5J8R-G94Q-2F39

Produtos afetados

Tfplan2Md

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27640.json · Exploit
• https://github.com/oocx/tfplan2md/releases/tag/v1.26.1 · Nota
• https://github.com/oocx/tfplan2md/security/advisories/GHSA-5j8r-g94q-2f39 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2026542941817262420 · Publicação no Twitter
• https://t.me/cveNotify/154138 · Publicação no Telegram
• https://t.me/cveNotify/153100 · Publicação no Telegram
• https://t.me/CVEtracker/45682 · Publicação no Telegram
• https://t.me/cveNotify/153562 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-27640 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2026641349760385519 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-27640 · Nota de Segurança
• https://twitter.com/cracbot/status/2028425208571609374 · Publicação no Twitter