CVE-2026-27640 in tfplan2md
Summary
by MITRE • 02/25/2026
tfplan2md is software for converting Terraform plan JSON files into human-readable Markdown reports. Prior to version 1.26.1, a bug in tfplan2md affected several distinct rendering paths: AzApi resource body properties, AzureDevOps variable groups, Scriban template context variables, and hierarchical sensitivity detection. This caused reports to render values that should have been masked as "(sensitive)" instead. This issue is fixed in v1.26.1. No known workarounds are available.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/06/2026
The vulnerability identified as CVE-2026-27640 affects tfplan2md, a tool designed to transform Terraform plan JSON outputs into human-readable Markdown documentation. This tool serves as an essential component in infrastructure as code workflows where Terraform plan files contain sensitive information that must be properly handled during documentation generation. The flaw manifests in multiple rendering pathways within the software's processing logic, specifically impacting how sensitive data is displayed in generated reports. The vulnerability represents a critical security oversight in information disclosure controls, where sensitive values that should remain masked are instead rendered in plain text within the documentation output. This affects the tool's ability to maintain confidentiality of sensitive configuration parameters, credentials, and other protected information that typically would be marked as "(sensitive)" in Terraform plan outputs.
The technical implementation flaw exists in the software's handling of various data types and rendering contexts within the tfplan2md processing pipeline. The vulnerability specifically impacts four distinct processing paths including AzApi resource body properties, AzureDevOps variable groups, Scriban template context variables, and hierarchical sensitivity detection mechanisms. These pathways represent different data structures and contexts within Terraform plan files where sensitive information might be present. The bug causes the software to fail in properly identifying and masking sensitive values during the Markdown conversion process, resulting in exposure of confidential information that should have been protected. This issue demonstrates a failure in the tool's data sanitization and rendering logic, where the sensitivity detection mechanisms are not properly applied across all code paths, leading to inconsistent security controls in the output generation process.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially compromise infrastructure security posture. When Terraform plan reports are generated with sensitive values exposed, organizations risk unauthorized access to credentials, API keys, database passwords, and other confidential parameters that are typically protected within infrastructure as code workflows. The vulnerability affects users who rely on tfplan2md for documentation and review processes, potentially exposing sensitive configuration details to unauthorized parties who might access these reports. This exposure could occur in environments where documentation files are shared across teams, stored in repositories, or distributed to stakeholders who should not have access to sensitive infrastructure parameters. The issue particularly impacts organizations using Azure services and DevOps pipelines where variable groups and API resource configurations contain critical security information.
Mitigation strategies for this vulnerability require immediate upgrade to tfplan2md version 1.26.1, which contains the necessary fixes for the sensitivity detection and rendering paths. Organizations should conduct immediate inventory checks to identify all systems and workflows utilizing affected versions of the tool, ensuring complete remediation across their infrastructure documentation processes. Security teams should review existing Terraform plan documentation files for potential exposure of sensitive information, particularly those generated before the fix was implemented. While no known workarounds exist for this specific vulnerability, organizations should implement additional access controls and review processes for documentation files, including restricting access to sensitive reports and implementing automated scanning for exposed credentials in generated documentation. The vulnerability aligns with CWE-200 (Information Exposure) and represents a failure in proper data masking and sanitization controls within the tool's processing pipeline, potentially mapping to ATT&CK techniques related to credential access and information gathering through compromised documentation systems.