Dell Ansible Storage for PowerStore: Improper certificate validation in API client
Summary
Dell Ansible Storage for PowerStore, the Ansible modules for managing Dell PowerStore storage arrays, does not properly validate certificates in its API client component (CWE-295). An unauthenticated attacker with remote access and a network position between the client and the PowerStore API could potentially intercept the connection, exposing information and gaining unauthorized access. The CVSS 3.1 base score is 7.4 (High), and the high attack complexity limits exploitation to specific conditions.
Affected
- Dell Ansible Storage for PowerStore (Ansible-PowerStore) versions prior to 3.9.0
Fixed in
- Version 3.9.0 or later (Dell DSA-2026-431)
Workaround
- Explicitly enable certificate verification by setting verify=True
Exploitation
- No known exploitation reported at the time of writing.
- No public proof of concept found.
- CISA KEV status not checked.
Our recommendation
- Check whether any PowerStore Ansible automation is in use, including through managed-service partners.
- Upgrade to version 3.9.0 or later together with CVE-2026-91872.
- Until patched, set verify=True in all playbooks and inventories and restrict the control node's network path to PowerStore.
- Ensure the PowerStore management endpoint uses a certificate that the control node trusts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell DSA-2026-431: Security Update for Dell Ansible Storage Multiple Vulnerabilities www.dell.com
- OffSeq Radar: CVE-2026-91871 radar.offseq.com
- CVE-2026-91871 mirror (threatint) cve.threatint.com
- OffSeq Radar: CVE-2026-91872 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:26.
Original description (NVD)
Dell Ansible Storage for PowerStore, versions prior to 3.9.0, contains an Improper Certificate Validation vulnerability in the API client component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.