PT-2026-21856 · Tfplan2Md · Tfplan2Md

Oocx · Published 2026-02-25 · Updated 2026-03-04 · CVE-2026-27640

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions tfplan2md versions prior to 1.26.1

Description tfplan2md is software used to convert Terraform plan JSON files into Markdown reports. Versions of the software prior to 1.26.1 had a flaw where sensitive values that should have been masked as "(sensitive)" were instead rendered in plain text in several rendering paths: AzApi resource body properties, AzureDevOps variable groups, Scriban template context variables, and hierarchical sensitivity detection. This resulted in potential exposure of sensitive data.

Recommendations Update to version 1.26.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-212

Related Identifiers

CVE-2026-27640

GHSA-5J8R-G94Q-2F39

Affected Products

Tfplan2Md

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27640.json · Exploit
• https://github.com/oocx/tfplan2md/security/advisories/GHSA-5j8r-g94q-2f39 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27640 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27640 · Security Note
• https://github.com/oocx/tfplan2md/releases/tag/v1.26.1 · Note
• https://twitter.com/VulmonFeeds/status/2026542941817262420 · Twitter Post
• https://t.me/cveNotify/154138 · Telegram Post
• https://t.me/cveNotify/153100 · Telegram Post
• https://t.me/CVEtracker/45682 · Telegram Post
• https://t.me/cveNotify/153562 · Telegram Post
• https://twitter.com/CVEnew/status/2026641349760385519 · Twitter Post
• https://twitter.com/cracbot/status/2028425208571609374 · Twitter Post