CVE-2026-27900: Terraform Linode Info Disclosure Flaw

CVE-2026-27900 Overview

CVE-2026-27900 is an Information Disclosure vulnerability affecting the Terraform Provider for Linode versions prior to v3.9.0. The vulnerability stems from the provider logging sensitive information—including passwords, StackScript content, and object storage data—to debug logs without proper redaction. While provider debug logging is not enabled by default, environments that explicitly enable debug or provider logs (such as during local troubleshooting, within CI/CD pipelines, or through centralized log collection) are at risk of exposing sensitive credentials.

An authenticated attacker with access to provider debug logs through log aggregation systems, CI/CD pipelines, or debug output could extract these sensitive credentials and potentially leverage them for unauthorized access to Linode infrastructure.

Critical Impact

Sensitive credentials including passwords, tokens, keys, and StackScript content may be exposed in debug logs, potentially allowing attackers to compromise Linode cloud infrastructure and resources.

Affected Products

• Terraform Provider for Linode versions prior to v3.9.0

Discovery Timeline

• 2026-02-26 - CVE CVE-2026-27900 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-27900

Vulnerability Analysis

This vulnerability is classified under CWE-532 (Insertion of Sensitive Information into Log File). The Terraform Provider for Linode was logging entire configuration option objects to debug logs, which included sensitive fields such as passwords, API tokens, cryptographic keys, and StackScript contents. When debug logging is enabled, these sensitive values are written to logs in plaintext.

The exposure occurs because the provider's logging functions were passing complete diskOpts and createOpts structs to the Terraform logging framework (tflog), rather than selectively logging only non-sensitive metadata. This design oversight means any environment capturing debug-level logs would inadvertently store sensitive credentials.

Root Cause

The root cause is improper handling of sensitive data in logging statements within the provider's helper and resource files. The code was using a pattern of logging entire option structs (e.g., "options": diskOpts) rather than explicitly selecting safe fields for logging. This violated the principle of least privilege for data exposure and failed to implement proper log sanitization for credentials and secrets.

Attack Vector

The attack vector requires network access with low attack complexity. An attacker must be an authenticated user with access to debug logs—this could be through:

1. CI/CD Pipeline Access: Developers or operators who can view pipeline execution logs where Terraform runs with debug enabled
2. Log Aggregation Systems: Users with access to centralized logging platforms (e.g., Splunk, ELK, CloudWatch) collecting Terraform debug output
3. Shared Debug Output: Scenarios where debug logs are shared during troubleshooting or support tickets

The scope is changed, meaning the vulnerability in one component (the Terraform provider) impacts resources beyond its security scope (Linode infrastructure credentials).

// Vulnerable code pattern - logging entire options struct
tflog.Debug(ctx, "client.CreateInstanceDisk(...)", map[string]any{
    "options": diskOpts,  // Exposes ALL fields including passwords, keys
})

// Fixed code pattern - logging only non-sensitive metadata
tflog.Debug(ctx, "client.CreateInstanceDisk(...) ", map[string]any{
    "label":      diskOpts.Label,
    "filesystem": diskOpts.Filesystem,
    "size":       diskOpts.Size,
    "image":      diskOpts.Image,
})

Source: GitHub Commit Details

Detection Methods for CVE-2026-27900

Indicators of Compromise

• Terraform provider debug logs containing full diskOpts or createOpts objects with visible password, token, or key fields
• Log entries showing StackScript content or object storage credentials in plaintext
• Unexpected access patterns to log aggregation systems or CI/CD pipeline logs
• Evidence of credential reuse or unauthorized API access to Linode accounts following log exposure

Detection Strategies

• Review Terraform provider version in use; versions prior to v3.9.0 are vulnerable when debug logging is enabled
• Audit CI/CD pipeline configurations for TF_LOG=DEBUG or TF_LOG_PROVIDER=DEBUG environment variables
• Search existing logs for patterns indicating exposed credentials such as "options": followed by credential-like data
• Monitor for unusual authentication events or API calls to Linode infrastructure that may indicate credential theft

Monitoring Recommendations

• Implement log scrubbing or masking rules in log aggregation platforms to redact potential credential patterns
• Configure alerts for debug-level Terraform logging being enabled in production environments
• Monitor access to historical logs that may contain sensitive data from vulnerable provider versions
• Track Linode API authentication events for anomalous access patterns

How to Mitigate CVE-2026-27900

Immediate Actions Required

• Upgrade to Terraform Provider for Linode version v3.9.0 or later immediately
• Disable Terraform provider debug logging or set log level to WARN or above in all environments
• Restrict access to existing and historical logs that may contain sensitive values
• Rotate all potentially exposed secrets and credentials including Linode API tokens, passwords, and access keys

Patch Information

The vulnerability has been patched in Terraform Provider for Linode version v3.9.0. The fix sanitizes debug logs by logging only non-sensitive metadata such as labels, regions, and resource IDs while redacting credentials, tokens, keys, scripts, and other sensitive content. The patch is available via the GitHub Release v3.9.0.

For detailed technical information about the fix, refer to the GitHub Security Advisory GHSA-5rc7-2jj6-mp64 and the GitHub Pull Request.

Workarounds

• Set TF_LOG environment variable to WARN, ERROR, or OFF to prevent debug-level logging
• Implement retention policies to purge or trim logs that may contain sensitive values
• Restrict access controls on log aggregation systems and CI/CD pipeline outputs
• Use Terraform's sensitive variable marking to help identify credentials that should not be logged

# Configuration example - Disable debug logging
export TF_LOG=WARN
export TF_LOG_PROVIDER=WARN

# Or completely disable logging
unset TF_LOG
unset TF_LOG_PROVIDER

# Verify provider version
terraform providers | grep linode
# Ensure version is >= v3.9.0