Dell Terraform Provider for PowerStore: Sensitive data exposure in diagnostic logs
Summary
Versions of the Dell Terraform Provider for PowerStore prior to 1.3.1 may not sufficiently redact sensitive authentication data in diagnostic logs. An attacker who can access these logs could obtain PowerStore credentials, which could then be used to change or delete storage configurations and data. The CNA record describes the attack as remote and unauthenticated, but the attack path is not explained in the sources and needs confirmation from Dell's advisory.
Affected
- Dell Terraform Provider for PowerStore, versions prior to 1.3.1 (CNA record: 0 to before 1.3.1)
- Related CVE-2026-91879 covers PowerStore versions 1.2.1 through 1.3.0 in the same advisory
Fixed in
- Version 1.3.1 (Dell has not explicitly linked the release changes to this CVE; the release notes describe matching redaction and debug logging changes)
Workaround
- No other mitigation is indicated by Dell beyond the upgrade.
- Interim measures (not vendor guidance): keep debug logging disabled, restrict access to Terraform run logs and workspace directories, and rotate PowerStore API credentials if old logs may contain them.
Exploitation
- No known exploitation in the wild.
- No public proof-of-concept found.
- Not listed in CISA KEV.
Our recommendation
- Identify all Terraform PowerStore provider versions in use, including CI runners and developer machines.
- Upgrade to version 1.3.1 or later by pinning the provider version and running terraform init -upgrade, then confirm against advisory DSA-2026-433.
- Search existing logs and artefacts for credentials and rotate any exposed PowerStore credentials.
- Confirm that debug logging is disabled by default in your environment.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell DSA-2026-433 Security Update www.dell.com
- CVE.org CVE Record CVE-2026-91891 www.cve.org
- GitHub release v1.3.1 github.com
- GitHub repository terraform-provider-powerstore github.com
- VulDB entry 435918 vuldb.com
- OffSeq Radar CVE-2026-91891 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:32.
Original description (NVD)
Dell Terraform Provider for PowerStore, versions prior to 1.3.1 , contains a vulnerability that may cause sensitive authentication data to be insufficiently redacted in diagnostic logs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.