Dell Terraform Provider for OME: Sensitive information exposed in error handling
Summary
Dell Terraform Provider for OME versions 1.0.0 through 1.2.3 contains an insertion of sensitive information into an externally accessible file or directory in its API client error handling (CWE-209). According to the CVE record, an unauthenticated remote attacker could potentially exploit this to obtain sensitive information, with a CVSS 3.1 base score of 8.6. The provider is an administrative infrastructure-as-code tool, so practical exposure depends on whether affected error output can be read by outsiders.
Affected
- Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3
- Exact data exposed: Unknown.
Fixed in
- Dell Terraform Provider for OME: version 1.2.4 or later
Workaround
- No workaround documented by the vendor. Upgrade to version 1.2.4 or later.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- Not listed in CISA KEV.
- No public exploit or proof of concept found; no known exploitation in the wild.
- EPSS about 0.4%.
Our recommendation
- Upgrade the Dell Terraform Provider for OME to version 1.2.4 or later as part of routine maintenance.
- Identify all Terraform configurations that use this provider.
- Restrict access to Terraform run output, CI/CD logs and state files, as error messages may appear there.
- Monitor the Dell advisory DSA-2026-434 and NVD for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell DSA-2026-434 security advisory www.dell.com
- GitHub release terraform-provider-ome v1.2.4 github.com
- GitHub pull request terraform-provider-ome #171 github.com
- Vulnrichment CVE-2026-91882 vulners.com
- OpenCVE CVE-2026-91882 app.opencve.io
- Strix CVE-2026-91882 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:12.
Original description (NVD)
Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in the API client error handling component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.