Cyber Posture

CVE-2026-27640

High

Published: 25 February 2026

Published
25 February 2026
Modified
04 March 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0005 14.9th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27640 is a high-severity Improper Removal of Sensitive Information Before Storage or Transfer (CWE-212) vulnerability in Oocx Tfplan2Md. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 14.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Credentials In Files (T1552.001) and 1 other technique.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-212

Eradication of spilled information from contaminated systems mitigates the effects of improper removal of sensitive data before storage or transfer.

addresses: CWE-212

The control requires verified removal of sensitive data before media is made available at a reduced classification level, directly addressing improper removal prior to storage or transfer.

addresses: CWE-212

Explicit procedures to delete inaccurate or outdated PII directly mitigate improper removal of sensitive information before storage or transfer.

addresses: CWE-212

Retention policies enforce removal or sanitization of sensitive data before storage or transfer per regulatory requirements.

addresses: CWE-212

The explicit requirement to delete inaccurate/outdated PII implements proper removal of sensitive information before further storage or transfer.

addresses: CWE-212

The control implements proper removal of sensitive information before storage or transfer of datasets.

addresses: CWE-212

The generate-on-demand-and-delete requirement enforces removal of sensitive information before storage or transfer, preventing improper retention.

addresses: CWE-212

Requires explicit removal of sensitive information prior to component transfer or disposal, reducing exposure from retained data.

MITRE ATT&CK Enterprise TechniquesAI

T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
T1213.003 Code Repositories Collection
Adversaries may leverage code repositories to collect valuable information.
Why these techniques?

Vulnerability causes sensitive credentials/secrets from Terraform plans to be written unmasked into Markdown reports (instead of redacted), directly enabling credential access from files and data retrieval from code repositories or CI artifacts where those reports are stored or shared.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

tfplan2md is software for converting Terraform plan JSON files into human-readable Markdown reports. Prior to version 1.26.1, a bug in tfplan2md affected several distinct rendering paths: AzApi resource body properties, AzureDevOps variable groups, Scriban template context variables, and hierarchical sensitivity…

more

detection. This caused reports to render values that should have been masked as "(sensitive)" instead. This issue is fixed in v1.26.1. No known workarounds are available.

Deeper analysisAI

CVE-2026-27640 is an information disclosure vulnerability (CWE-212) in tfplan2md, a tool for converting Terraform plan JSON files into human-readable Markdown reports. Published on 2026-02-25, it affects versions prior to 1.26.1 and stems from a bug impacting multiple rendering paths, including AzApi resource body properties, AzureDevOps variable groups, Scriban template context variables, and hierarchical sensitivity detection. These flaws cause the tool to render actual sensitive values in reports rather than masking them as "(sensitive)", with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

The vulnerability can be exploited by any network-accessible attacker requiring no privileges, low complexity, or user interaction. By obtaining the generated Markdown reports—potentially through shared CI/CD pipelines, public repositories, or other distribution channels—attackers can achieve high-impact confidentiality breaches, exposing sensitive Terraform plan data such as credentials, secrets, or configuration details that were intended to be protected.

The issue is fully resolved in tfplan2md version 1.26.1. No workarounds are available. For mitigation details, refer to the GitHub release notes at https://github.com/oocx/tfplan2md/releases/tag/v1.26.1 and the security advisory at https://github.com/oocx/tfplan2md/security/advisories/GHSA-5j8r-g94q-2f39.

Details

CWE(s)

Affected Products

oocx
tfplan2md
≤ 1.26.1

CVEs Like This One

CVE-2024-8474Shared CWE-212
CVE-2026-43824Shared CWE-212
CVE-2024-43384Shared CWE-212
CVE-2026-42880Shared CWE-212
CVE-2026-34214Shared CWE-212
CVE-2026-32891Shared CWE-212

References