Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-27900

The Terraform Provider for Linode versions prior to v3.9.0 logged sensitive information including some passwords, StackScript content, and object storage data in debug logs without redaction. Provider debug logging is not enabled by default. This issue is exposed when debug/provider logs are explicitly enabled (for example in local troubleshooting, CI/CD jobs, or centralized log collection). If enabled, sensitive values may be written to logs and then retained, shared, or exported beyond the ori
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:ac5fb55a5c7b455886ec557b3c6c90236154cb785a7bfd1f72184dcc679cce07
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"terraform-provider-linode","vendor":"linode","versions":[{"status":"affected","version":"< 3.9.0"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:841d1630000e231629195944153a21715827a1b09141705579ac913c1c392e31 · sha256:05b0252e12a1e660… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:841d1630000e231629195944153a21715827a1b09141705579ac913c1c392e31 · sha256:05b0252e12a1e660… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-532","description":"CWE-532: Insertion of Sensitive Information into Log File","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:841d1630000e231629195944153a21715827a1b09141705579ac913c1c392e31 · sha256:05b0252e12a1e660… · /containers/cna/problemTypes/0/descriptions/0

Source references

5 source assertions
{"url":"http://www.openwall.com/lists/oss-security/2026/02/26/2"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:841d1630000e231629195944153a21715827a1b09141705579ac913c1c392e31 · sha256:05b0252e12a1e660… · /containers/adp/0/references/0
{"name":"https://github.com/linode/terraform-provider-linode/commit/43a925d826b999f0355de3dc7330c55f496824c0","tags":["x_refsource_MISC"],"url":"https://github.com/linode/terraform-provider-linode/commit/43a925d826b999f0355de3dc7330c55f496824c0"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:841d1630000e231629195944153a21715827a1b09141705579ac913c1c392e31 · sha256:05b0252e12a1e660… · /containers/cna/references/2
{"name":"https://github.com/linode/terraform-provider-linode/pull/2269","tags":["x_refsource_MISC"],"url":"https://github.com/linode/terraform-provider-linode/pull/2269"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:841d1630000e231629195944153a21715827a1b09141705579ac913c1c392e31 · sha256:05b0252e12a1e660… · /containers/cna/references/1
{"name":"https://github.com/linode/terraform-provider-linode/releases/tag/v3.9.0","tags":["x_refsource_MISC"],"url":"https://github.com/linode/terraform-provider-linode/releases/tag/v3.9.0"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:841d1630000e231629195944153a21715827a1b09141705579ac913c1c392e31 · sha256:05b0252e12a1e660… · /containers/cna/references/3
{"name":"https://github.com/linode/terraform-provider-linode/security/advisories/GHSA-5rc7-2jj6-mp64","tags":["x_refsource_CONFIRM"],"url":"https://github.com/linode/terraform-provider-linode/security/advisories/GHSA-5rc7-2jj6-mp64"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:841d1630000e231629195944153a21715827a1b09141705579ac913c1c392e31 · sha256:05b0252e12a1e660… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer