Skip to content

Commit 7eb948d

Browse files
advisory-database[bot]advisory-database[bot]
committed
1 parent 948c388 commit 7eb948d

1 file changed

Lines changed: 115 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/02/GHSA-5rc7-2jj6-mp64/GHSA-5rc7-2jj6-mp64.json‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5rc7-2jj6-mp64",
4+
"modified": "2026-02-26T20:00:12Z",
5+
"published": "2026-02-26T20:00:12Z",
6+
"aliases": [
7+
"CVE-2026-27900"
8+
],
9+
"summary": "Terraform Provider for Linode Debug Logs Vulnerable to Sensitive Information Exposure",
10+
"details": "### Impact\nThe Terraform Provider for Linode versions prior to v3.9.0 logged sensitive information including some passwords, StackScript content, object storage data, and NodeBalancer TLS keys in debug logs without redaction.\n\n**Important:** Provider debug logging is **not enabled by default**. \nThis issue is exposed when debug/provider logs are explicitly enabled (for example in local troubleshooting, CI/CD jobs, or centralized log collection). If enabled, sensitive values may be written to logs and then retained, shared, or exported beyond the original execution environment.\n\nSpecifically:\n- Instance creation operations logged the full InstanceCreateOptions struct containing RootPass and StackScriptData\n- Instance disk creation logged InstanceDiskCreateOptions containing RootPass and StackscriptData\n- StackScript update operations logged the complete script content via StackscriptUpdateOptions.Script\n- Image share group member creation logged tokens in ImageShareGroupAddMemberOptions.Token\n- Object storage operations logged full PutObjectInput structures containing user data\n- NodeBalancer config create and update operations logged NodeBalancerConfigCreateOptions and NodeBalancerConfigUpdateOptions containing the SSLKey (TLS private key)\n\nAn authenticated user with access to provider debug logs (through log aggregation systems, CI/CD pipelines, or debug output) would thus be able to extract these sensitive credentials.\n\n### Patches\nUpdate to version v3.9.0 or later, which sanitizes debug logs by logging only non-sensitive metadata such as labels, regions, and resource IDs while redacting credentials, tokens, keys, scripts, and other sensitive content.\n\n### Workarounds and Mitigations\n- Disable Terraform/provider debug logging or set it to `WARN` level or above\n - To disable the logging, you can unset `TF_LOG_PROVIDER` and `TF_LOG` environment variables\n - Or you can set them to `WARN` or `ERROR` levels to avoid sensitive information logged in `INFO` and `DEBUG` levels.\n - See Terraform docs for details: https://developer.hashicorp.com/terraform/internals/debugging\n- Restrict access to existing and historical logs\n- Purge/retention-trim logs that may contain sensitive values\n- Rotate potentially exposed secrets/credentials, including:\n - Root passwords\n - Image share group tokens\n - TLS private keys/certificates used in NodeBalancer configs\n - StackScript content/secrets if embedded\n\n### Credits\nThis issue was reported to Terraform by Hasan Sheet via [Akamai's HackerOne Bug Bounty program](https://hackerone.com/akamai).\n\n### Resources\nhttps://github.com/linode/terraform-provider-linode/releases/tag/v3.9.0\nhttps://github.com/linode/terraform-provider-linode/pull/2269\nhttps://github.com/linode/terraform-provider-linode/commit/43a925d826b999f0355de3dc7330c55f496824c0",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/linode/terraform-provider-linode/v3"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.9.0"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Go",
40+
"name": "github.com/linode/terraform-provider-linode/v2"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"last_affected": "2.41.2"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Go",
59+
"name": "github.com/linode/terraform-provider-linode"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "0"
67+
},
68+
{
69+
"last_affected": "1.30.0"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/linode/terraform-provider-linode/security/advisories/GHSA-5rc7-2jj6-mp64"
80+
},
81+
{
82+
"type": "ADVISORY",
83+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27900"
84+
},
85+
{
86+
"type": "WEB",
87+
"url": "https://github.com/linode/terraform-provider-linode/pull/2269"
88+
},
89+
{
90+
"type": "WEB",
91+
"url": "https://github.com/linode/terraform-provider-linode/commit/43a925d826b999f0355de3dc7330c55f496824c0"
92+
},
93+
{
94+
"type": "PACKAGE",
95+
"url": "https://github.com/linode/terraform-provider-linode"
96+
},
97+
{
98+
"type": "WEB",
99+
"url": "https://github.com/linode/terraform-provider-linode/releases/tag/v3.9.0"
100+
},
101+
{
102+
"type": "WEB",
103+
"url": "http://www.openwall.com/lists/oss-security/2026/02/26/2"
104+
}
105+
],
106+
"database_specific": {
107+
"cwe_ids": [
108+
"CWE-532"
109+
],
110+
"severity": "MODERATE",
111+
"github_reviewed": true,
112+
"github_reviewed_at": "2026-02-26T20:00:12Z",
113+
"nvd_published_at": "2026-02-26T02:16:20Z"
114+
}
115+
}

0 commit comments

Comments
 (0)