Dell Terraform Provider for PowerFlex: Improper certificate validation in SSH client
Summary
Dell's Terraform Provider for PowerFlex uses ssh.InsecureIgnoreHostKey() as its default SSH host key callback, so it does not properly verify the identity of the SSH host it connects to. An attacker with a network position to intercept or redirect SSH connections could potentially obtain information and gain unauthorized access. Exploitation requires a suitable network position and the attack complexity is rated high.
Affected
- Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0 (according to the CVE description)
- Conflicting sources also state versions below 1.9.0 or up to 1.8.0. Unknown whether versions before 1.5.0 are affected. Treat all versions below 1.9.0 as affected until Dell clarifies.
Fixed in
- Version 1.9.0 or later (according to secondary sources and the upstream release notes; the Dell advisory was not verified)
Workaround
Unknown. Dell has not published a workaround in the sources reviewed. Explicitly setting the SSH host key on affected resources may reduce exposure, but this is unverified and must be tested before use.
Exploitation
- No evidence of exploitation in the wild found in the sources reviewed.
- No public proof-of-concept exploit found as of publication.
Our recommendation
- Identify all systems running terraform-provider-powerflex below version 1.9.0, including workstations, CI/CD pipelines and state-management hosts.
- Upgrade to version 1.9.0 or later.
- Review SSH host key handling in your Terraform code and use known_hosts-based verification.
- Limit Terraform runs to trusted networks until the upgrade is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-91880 www.cve.org
- Dell DSA-2026-433 Security Update www.dell.com
- terraform-provider-powerflex release v1.9.0 github.com
- VulDB CVE-2026-91880 vuldb.com
- OffSeq Radar CVE-2026-91880 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:22.
Original description (NVD)
Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0, contains an Improper Certificate Validation vulnerability in the SSH client component.Terraform PowerFlex provider uses ssh.InsecureIgnoreHostKey() as the default SSH host key callback. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.