Vulnerability · Published Feb 25, 2026 · Assigned by GitHub_M

CVE-2026-27640tfplan2md has Sensitive Value Exposure in Generated Reports

High 8.5

In plain English

A high-severity security flaw in tfplan2md from oocx. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 4.0)8.5High

Exploit odds (30 days)0.3%top 72.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

tfplan2md is software for converting Terraform plan JSON files into human-readable Markdown reports. Prior to version 1.26.1, a bug in tfplan2md affected several distinct rendering paths: AzApi resource body properties, AzureDevOps variable groups, Scriban template context variables, and hierarchical sensitivity detection. This caused reports to render values that should have been masked as "(sensitive)" instead. This issue is fixed in v1.26.1. No known workarounds are available.

Affected products (as reported)

Vendor	Product	Versions
oocx	tfplan2md	< 1.26.1

Weakness: CWE-212 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

References

https://github.com/oocx/tfplan2md/security/advisories/GHSA-5j8r-g94q-2f39 x_refsource_CONFIRM
https://github.com/oocx/tfplan2md/releases/tag/v1.26.1 x_refsource_MISC