PT-2026-22075 · Linode · Terraform-Provider-Linode

Hasan Sheet · Published 2026-02-26 · Updated 2026-03-25 · CVE-2026-27900

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Terraform Provider for Linode versions prior to 3.9.0

Description The Terraform Provider for Linode logged sensitive information, including passwords, StackScript content, and object storage data, in debug logs without redaction. This issue is present when debug/provider logs are explicitly enabled. An authenticated user with access to these logs could extract sensitive credentials. The provider versions 3.9.0 and later sanitize debug logs by redacting sensitive content and logging only non-sensitive metadata.

Recommendations Disable Terraform/provider debug logging or set it to WARN level or above. Restrict access to existing and historical logs. Purge/retention-trim logs that may contain sensitive values. Rotate potentially exposed secrets/credentials.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-27900

GHSA-5RC7-2JJ6-MP64

GO-2026-4562

SUSE-SU-2026:1042-1

Affected Products

Terraform-Provider-Linode

References · 146

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27900.json · Exploit
• https://github.com/linode/terraform-provider-linode/pull/2269 · Patch
• https://github.com/linode/terraform-provider-linode/commit/43a925d826b999f0355de3dc7330c55f496824c0 · Patch
• https://github.com/linode/terraform-provider-linode/security/advisories/GHSA-5rc7-2jj6-mp64 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27900 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5rc7-2jj6-mp64 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4562 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27900 · Security Note
• https://github.com/linode/terraform-provider-linode/releases/tag/v3.9.0 · Note
• https://github.com/linode/terraform-provider-linode · Note
• https://suse.com/security/cve/CVE-2026-31961 · Note
• https://suse.com/security/cve/CVE-2026-31817 · Note
• https://suse.com/security/cve/CVE-2026-26276 · Note
• https://suse.com/security/cve/CVE-2026-22728 · Note