What is CVE-2026-27640?

CVE-2026-27640 is a high-severity vulnerability in Oocx Tfplan2md, classified under Improper Removal of Sensitive Information Before Storage or Transfer. CVSS score: 7.5/10. Published 2026-02-25.

How severe is CVE-2026-27640?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Oocx Tfplan2md

CVE-2026-27640

tfplan2md is software for converting Terraform plan JSON files into human-readable Markdown reports. Prior to version 1.26.1, a bug in tfplan2md affected several distinct rendering paths: AzApi resource body properties, AzureDevOps variable groups, Scriban template context variables, and hierarchical sensitivity detection. This caused reports to render values that should have been masked as "(sensitive)" instead. This issue is fixed in v1.26.1. No known workarounds are available.

EPSS: 0.003 (21.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Oocx Tfplan2md — versions < 1.26.1

Weakness classification (CWE)

CWE-212 — Improper Removal of Sensitive Information Before Storage or Transfer

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Product, x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2026-27640?: CVE-2026-27640 is a high-severity vulnerability in Oocx Tfplan2md, classified under Improper Removal of Sensitive Information Before Storage or Transfer. CVSS score: 7.5/10. Published 2026-02-25.
How severe is CVE-2026-27640?: High severity. CVSS v3 base score is 7.5 out of 10.