{"id":"CVE-2026-91871","kind":"vulnerability","aliases":["CVE-2026-91871"],"related":[],"title":"Dell Ansible Storage for PowerStore: certificate validation flaw exposes API traffic","description":"Dell Ansible Storage for PowerStore, versions prior to 3.9.0, contains an Improper Certificate Validation vulnerability in the API client component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.","summary":"Dell Ansible Storage for PowerStore versions before 3.9.0 do not properly validate certificates in the API client. An unauthenticated attacker with remote access could intercept or impersonate the storage API, exposing information and gaining unauthorized access.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ansible","dell-powerstore","infrastructure","storage"],"not_affected_if":["version-3.9.0-or-later"],"how_to_check":"- Check the installed Dell Ansible Storage for PowerStore collection version and confirm whether it is below `3.9.0`\n- Look for PowerStore API client configuration that disables certificate verification, if the sources do not say more: unknown","fix":"- Dell Ansible Storage for PowerStore: move to `3.9.0` or later","status":"open","published_at":"2026-11-11T18:19:53+00:00","first_seen_at":"2026-11-11T18:28:44+00:00","triaged_at":"2026-11-11T18:29:29+00:00","updated_at":"2026-11-11T18:29:29+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-11T18:29:29Z","model":"claude-haiku-5-5","output":{"fix":"- Dell Ansible Storage for PowerStore: move to `3.9.0` or later","reach":"network","title":"Dell Ansible Storage for PowerStore: certificate validation flaw exposes API traffic","impact":"high","summary":"Dell Ansible Storage for PowerStore versions before 3.9.0 do not properly validate certificates in the API client. An unauthenticated attacker with remote access could intercept or impersonate the storage API, exposing information and gaining unauthorized access.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ansible","dell-powerstore","storage"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker intercepts storage API traffic and gains unauthorized access","analyst_note":"Confirm the affected Dell advisory and whether the certificate check bypass has any non-default precondition; the NVD entry gives no product range beyond prior to 3.9.0.","how_to_check":"- Check the installed Dell Ansible Storage for PowerStore collection version and confirm whether it is below `3.9.0`\n- Look for PowerStore API client configuration that disables certificate verification, if the sources do not say more: unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-3.9.0-or-later"],"who_is_affected":"Teams that run Dell Ansible Storage for PowerStore collections below version 3.9.0 to manage PowerStore storage arrays over the network. The sources do not describe further configuration conditions, so treat any such deployment as potentially exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000751,"input_tokens":4554,"output_tokens":591,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91871':14A,17A '3.9.0':31B,68C 'access':46B,59B,85C,97C 'ansibl':2A,18B,25B,61C 'api':10A,39B,53B,77C 'attack':43B,82C 'certif':6A,36B,72C 'client':40B,78C 'compon':79C 'contain':69C 'could':47B,86C 'cve':12A,15A 'dell':1A,20B,24B,60C 'dell-powerstor':19B 'exploit':88C 'expos':9A,54B 'exposur':94C 'flaw':8A 'gain':57B 'imperson':50B 'improp':71C 'inform':55B,93C 'infrastructur':22B 'intercept':48B 'lead':91C 'potenti':87C 'powerstor':5A,21B,28B,64C 'prior':66C 'proper':34B 'remot':45B,84C 'storag':3A,23B,26B,52B,62C 'traffic':11A 'unauthent':42B,81C 'unauthor':58B,96C 'valid':7A,35B,73C 'version':29B,65C 'vulner':74C,90C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Dell Ansible Storage for PowerStore collections below version 3.9.0 to manage PowerStore storage arrays over the network. The sources do not describe further configuration conditions, so treat any such deployment as potentially exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ansible","dellpowerstore","high","infrastructure","storage"],"campaign_type":null,"search_a":"'-2026':13A,16A '-91871':14A,17A 'ansibl':2A 'api':10A 'certif':6A 'cve':12A,15A 'dell':1A 'expos':9A 'flaw':8A 'powerstor':5A 'storag':3A 'traffic':11A 'valid':7A","search_b":"'3.9.0':31B 'access':46B,59B 'ansibl':18B,25B 'api':39B,53B 'attack':43B 'certif':36B 'client':40B 'could':47B 'dell':20B,24B 'dell-powerstor':19B 'expos':54B 'gain':57B 'imperson':50B 'inform':55B 'infrastructur':22B 'intercept':48B 'powerstor':21B,28B 'proper':34B 'remot':45B 'storag':23B,26B,52B 'unauthent':42B 'unauthor':58B 'valid':35B 'version':29B","search_c":"'3.9.0':68C 'access':85C,97C 'ansibl':61C 'api':77C 'attack':82C 'certif':72C 'client':78C 'compon':79C 'contain':69C 'could':86C 'dell':60C 'exploit':88C 'exposur':94C 'improp':71C 'inform':93C 'lead':91C 'potenti':87C 'powerstor':64C 'prior':66C 'remot':84C 'storag':62C 'unauthent':81C 'unauthor':96C 'valid':73C 'version':65C 'vulner':74C,90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T18:19:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91871","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91871","severity":null,"published_at":"2026-11-11T18:19:53+00:00","modified_at":"2026-11-11T18:19:53+00:00","first_seen_at":"2026-11-11T18:28:44+00:00","fetched_at":"2026-11-11T18:28:44+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}