---
id: "CVE-2026-68862"
page: "https://infrastack.ai/live/CVE-2026-68862"
kind: "vulnerability"
aliases: ["CVE-2026-68862"]
title: "Dell Terraform Provider for PowerFlex: command injection on provisioned SDC hosts"
severity: "medium"
cvss: 6.6
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["dell-powerflex", "self-hosted", "terraform", "vendor"]
not_affected_if: ["no-terraform-provider"]
published_at: "2026-11-11T18:19:49+00:00"
first_seen_at: "2026-11-11T18:28:43+00:00"
updated_at: "2026-11-11T18:29:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68862", "first_seen_at": "2026-11-11T18:28:43+00:00"}]
exploit_sources: []
---

# Dell Terraform Provider for PowerFlex: command injection on provisioned SDC hosts

Link for people: https://infrastack.ai/live/CVE-2026-68862 (this .md is for agents)

The Dell Terraform Provider for Dell PowerFlex has an OS command injection flaw in its SDC host provisioning component. A remote attacker with high privileges on the PowerFlex management plane could run arbitrary OS commands on provisioned SDC hosts, potentially fully compromising them.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-11T18:28:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-68862

## From the sources

Dell Terraform Provider for Dell PowerFlex contain(s) an OS Command Injection Vulnerability in the SDC host provisioning component. A high privileged remote attacker with access to the PowerFlex management plane could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on provisioned SDC hosts. Exploitation may lead to full compromise of affected SDC hosts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_