« Volver al listado

CVE-2026-27900

Estado: AnalizadaAlta (7.7)—

The Terraform Provider for Linode versions prior to v3.9.0 logged sensitive information including some passwords, StackScript content, and object storage data in debug logs without redaction. Provider debug logging is not enabled by default. This issue is exposed when debug/provider logs are explicitly enabled (for example in local troubleshooting, CI/CD jobs, or centralized log collection). If enabled, sensitive values may be written to logs and then retained, shared, or exported beyond the original execution environment.

Leer descripción completaMostrar menos

An authenticated user with access to provider debug logs (through log aggregation systems, CI/CD pipelines, or debug output) would thus be able to extract these sensitive credentials. Versions 3.9.0 and later sanitize debug logs by logging only non-sensitive metadata such as labels, regions, and resource IDs while redacting credentials, tokens, keys, scripts, and other sensitive content. Some other mitigations and workarounds are available. Disable Terraform/provider debug logging or set it to `WARN` level or above, restrict access to existing and historical logs, purge/retention-trim logs that may contain sensitive values, and/or rotate potentially exposed secrets/credentials.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS AV:N/PR:L indica acceso remoto autenticado sin interacción (T1210). El CWE-532 y descripción revelan exposición de credenciales y tokens en logs de depuración (T1552.001: credenciales en archivos). La confidencialidad alta y acceso a contraseñas/claves sustenta el impacto de lectura de d

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningUser TrainingThreat Intelligence ProgramRestrict File and Directory PermissionsPrivileged Account ManagementPassword Policies

Tecnologías afectadas (1)

Terraform — Linode Provider

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-27900",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-27900",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-26T14:35:17.379849Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "linode",
          "product": "terraform-provider-linode",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.9.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-26T02:16:20.770",
  "references": [
    {
      "url": "https://github.com/linode/terraform-provider-linode/commit/43a925d826b999f0355de3dc7330c55f496824c0",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/linode/terraform-provider-linode/pull/2269",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/linode/terraform-provider-linode/releases/tag/v3.9.0",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/linode/terraform-provider-linode/security/advisories/GHSA-5rc7-2jj6-mp64",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/02/26/2",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Terraform Provider for Linode versions prior to v3.9.0 logged sensitive information including some passwords, StackScript content, and object storage data in debug logs without redaction. Provider debug logging is not enabled by default. This issue is exposed when debug/provider logs are explicitly enabled (for example in local troubleshooting, CI/CD jobs, or centralized log collection). If enabled, sensitive values may be written to logs and then retained, shared, or exported beyond the original execution environment. An authenticated user with access to provider debug logs (through log aggregation systems, CI/CD pipelines, or debug output) would thus be able to extract these sensitive credentials. Versions 3.9.0 and later sanitize debug logs by logging only non-sensitive metadata such as labels, regions, and resource IDs while redacting credentials, tokens, keys, scripts, and other sensitive content. Some other mitigations and workarounds are available. Disable Terraform/provider debug logging or set it to `WARN` level or above, restrict access to existing and historical logs, purge/retention-trim logs that may contain sensitive values, and/or rotate potentially exposed secrets/credentials."
    },
    {
      "lang": "es",
      "value": "El proveedor de Terraform para Linode versiones anteriores a la v3.9.0 registró información sensible, incluyendo algunas contraseñas, contenido de StackScript y datos de almacenamiento de objetos, en los registros de depuración sin redacción. El registro de depuración del proveedor no está habilitado por defecto. Este problema se expone cuando los registros de depuración/proveedor se habilitan explícitamente (por ejemplo, en la resolución de problemas local, trabajos de CI/CD o recolección centralizada de registros). Si está habilitado, los valores sensibles pueden escribirse en los registros y luego retenerse, compartirse o exportarse más allá del entorno de ejecución original. Un usuario autenticado con acceso a los registros de depuración del proveedor (a través de sistemas de agregación de registros, pipelines de CI/CD o salida de depuración) podría así extraer estas credenciales sensibles. Las versiones 3.9.0 y posteriores sanean los registros de depuración registrando solo metadatos no sensibles como etiquetas, regiones e IDs de recursos, mientras redactan credenciales, tokens, claves, scripts y otro contenido sensible. Algunas otras mitigaciones y soluciones alternativas están disponibles. Deshabilite el registro de depuración de Terraform/proveedor o configúrelo al nivel WARN o superior, restrinja el acceso a los registros existentes e históricos, purgue/recorte por retención los registros que puedan contener valores sensibles, y/o rote los secretos/credenciales potencialmente expuestos."
    }
  ],
  "lastModified": "2026-06-17T10:27:50.833",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:terraform:linode_provider:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F84899D2-CBC5-46AA-9147-C6262BA3C0A7",
              "versionEndExcluding": "3.9.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}