TERRAFORM-PROVIDER-OBJECTSCALE · CVE-2026-91879 · Vendor
FIX → 1.1.1 · 1.3.1 ✓ verified
Dell's Terraform providers for ObjectScale (before 1.1.1) and PowerStore (1.2.1 through 1.3.0) write sensitive information into log files during client initialization. An attacker with low privileges and remote access could read those logs and gain unauthorized access.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that manage Dell ObjectScale or PowerStore storage with the Dell Terraform providers. Affected: ObjectScale provider before 1.1.1 and PowerStore provider 1.2.1 through 1.3.0; sensitive information is written to logs during client initialization, so anyone who can read those logs (local, CI, shared log stores) may obtain credentials. Teams not using these providers, or on fixed versions, can skip it.
Not affected if not-using-dell-terraform-providers, provider-version-fixed
Who cares dell, infrastructure-as-code, objectscale, powerstore, self-hosted, terraform
terraform providers)1.1.1 or PowerStore is 1.2.1 through Dell Terraform for ObjectScale and Powerstore, versions prior to 1.1.1 (ObjectScale) and versions 1.2.1 through 1.3.0 (PowerStore) contains an insertion of sensitive information into Log File vulnerability in the client initialization component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
1.3.0Upgrade to 1.1.1 · 1.3.1
Upgrade Terraform Provider for ObjectScale to 1.1.1 or later; Terraform Provider for PowerStore to 1.3.1 or later (Dell DSA-2026-433).