Dell Terraform Provider: Sensitive information written to log file
Summary
Dell Terraform providers for ObjectScale and PowerStore write sensitive information to log files in the client initialization component. According to the CVE description, a low-privileged attacker with remote access could obtain this data, which may lead to information disclosure and unauthorized access. Exposure is most relevant where Terraform log output or log files can be read, for example on shared CI runners or admin workstations. The CVSS vector and the remote access condition are not yet verified against the Dell advisory.
Affected
- ObjectScale: versions prior to 1.1.1 (according to CVE description)
- PowerStore: versions 1.2.1 through 1.3.0 (according to CVE description); the official CVE record lists versions prior to 1.3.1
Fixed in
- ObjectScale: 1.1.1 or later
- PowerStore: 1.3.1 or later according to the official CVE record; not yet confirmed on the Dell advisory. Unknown in the verified sources.
Workaround
- No Dell-specific workaround known. Check the Dell advisory DSA-2026-433 for mitigations.
- Restrict read access to Terraform log files and review where logs are written (for example via TF_LOG_PATH).
Exploitation
No evidence of exploitation in the wild and no public proof of concept found at the time of writing. Coverage is minimal because the CVE was published recently.
Our recommendation
- Inventory all Terraform configurations and lock files that use the Dell PowerStore or ObjectScale providers, and record the versions in use.
- Update to the fixed versions and confirm the exact fix on Dell advisory DSA-2026-433.
- Restrict access to Terraform logs and disable file-based logging where not needed.
- Rotate storage credentials used in affected Terraform runs if logs may have been exposed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell DSA-2026-433: Security Update for Dell Terraform Provider for Dell Storage www.dell.com
- CVE-2026-91883 record (threatint) cve.threatint.com
- CVE-2026-91872 record (threatint), comparable Dell log-leak CVE cve.threatint.com
- Microsoft Terraform provider advisory GHSA-7w3w-pjm5-m36c (comparable log leak, general practice) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:21.
Original description (NVD)
Dell Terraform for ObjectScale and Powerstore, versions prior to 1.1.1 (ObjectScale) and versions 1.2.1 through 1.3.0 (PowerStore) contains an insertion of sensitive information into Log File vulnerability in the client initialization component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.