Dell Ansible Storage for PowerFlex: Improper certificate validation in API client
Summary
Dell Ansible Storage for PowerFlex versions before 3.2.0 do not properly validate certificates in the API client component. A network-positioned attacker who can intercept or redirect traffic between the Ansible control node and the PowerFlex management host could potentially gain information exposure and unauthorized access. The attack has high complexity and requires no privileges or user interaction.
Affected
- Dell Ansible Storage for PowerFlex (Ansible-PowerFlex), all versions prior to 3.2.0
Fixed in
- Version 3.2.0 or later (according to Dell advisory DSA-2026-431; the release artifact could not be independently verified)
Workaround
- Explicitly enable certificate verification by setting verify_certificate=True (per Dell advisory)
Exploitation
- No public proof of concept found at time of research.
- No evidence of exploitation in the wild reported.
- CISA KEV status not checked.
Our recommendation
- Identify whether PowerFlex Ansible modules (dellemc.powerflex) are in use.
- Upgrade to version 3.2.0 or later.
- Until patched, set verify_certificate=True in playbooks and limit network paths between the Ansible control node and PowerFlex to an isolated internal network.
- Review and rotate credentials used by playbooks if exposure is suspected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell DSA-2026-431 security advisory www.dell.com
- CVE record CVE-2026-91870 www.cve.org
- OffSeq Radar: CVE-2026-91870 radar.offseq.com
- Ansible PowerFlex GitHub releases github.com
- Ansible PowerFlex CHANGELOG github.com
- dellemc.powerflex SDS module documentation docs.ansible.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:25.
Original description (NVD)
Dell Ansible Storage for PowerFlex, versions prior to 3.2.0, contains an Improper Certificate Validation vulnerability in the API client component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.