{"id":"CVE-2026-91879","kind":"vulnerability","aliases":["CVE-2026-91879"],"related":[],"title":"Dell Terraform providers for ObjectScale and PowerStore leak credentials into log files","description":"Dell Terraform for ObjectScale and Powerstore, versions prior to 1.1.1 (ObjectScale) and versions 1.2.1 through 1.3.0 (PowerStore) contains an insertion of sensitive information into Log File vulnerability in the client initialization component.  A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.","summary":"Dell's Terraform providers for ObjectScale (before 1.1.1) and PowerStore (1.2.1 through 1.3.0) write sensitive information into log files during client initialization. An attacker with low privileges and remote access could read those logs and gain unauthorized access.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"terraform-provider-objectscale","fixed":["1.1.1"],"affected":"< 1.1.1","ecosystem":"vendor"},{"name":"terraform-provider-powerstore","fixed":["1.3.1"],"affected":">= 1.2.1, <= 1.3.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["dell","infrastructure-as-code","objectscale","powerstore","self-hosted","terraform","vendor"],"not_affected_if":["not-using-dell-terraform-providers","provider-version-fixed"],"how_to_check":"Find the dell objectscale and powerstore providers in required_providers and .terraform.lock.hcl (or run 'terraform providers'). Exposed if ObjectScale is below 1.1.1 or PowerStore is 1.2.1 through 1.3.0. Then review existing Terraform logs and CI output from runs using those versions for credentials/tokens and rotate any found. Dell does not say which log settings trigger the write for this CVE.","fix":"Upgrade Terraform Provider for ObjectScale to 1.1.1 or later; Terraform Provider for PowerStore to 1.3.1 or later (Dell DSA-2026-433).","status":"open","published_at":"2026-11-11T18:19:53+00:00","first_seen_at":"2026-11-11T18:28:44+00:00","triaged_at":"2026-11-11T18:29:16+00:00","updated_at":"2026-11-11T18:29:48+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-11T18:29:16Z","model":"claude-haiku-5-5","output":{"fix":"- Dell ObjectScale Terraform provider: move to `1.1.1` or later\n- Dell PowerStore Terraform provider: versions `1.2.1` through `1.3.0` are affected; the sources do not name the fixed version\n- unknown","reach":"network","title":"Dell Terraform providers for ObjectScale and PowerStore leak credentials into log files","impact":"high","summary":"Dell's Terraform providers for ObjectScale (before 1.1.1) and PowerStore (1.2.1 through 1.3.0) write sensitive information into log files during client initialization. An attacker with low privileges and remote access could read those logs and gain unauthorized access.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["terraform","dell","objectscale","powerstore","infrastructure-as-code"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"credentials written to logs let an attacker reach storage systems","analyst_note":"Confirm the fixed PowerStore version and which log settings trigger the credential write; check https://nvd.nist.gov/vuln/detail/CVE-2026-91879 and Dell's advisory.","how_to_check":"- Check the installed Dell ObjectScale and PowerStore Terraform provider versions in the `required_providers` block of your Terraform configuration and in `.terraform.lock.hcl`\n- Review Terraform log output (for example files written when `TF_LOG` is set) for stored credentials\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-using-dell-terraform-providers"],"who_is_affected":"Teams that use the Dell ObjectScale or PowerStore Terraform providers to manage storage infrastructure are exposed, since the flaw is in the provider's client initialization code. The sources do not say whether the logging depends on a particular configuration. Teams not using these providers can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000814,"input_tokens":4605,"output_tokens":707,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed PowerStore version and which log settings trigger the credential write; check https://nvd.nist.gov/vuln/detail/CVE-2026-91879 and Dell's advisory.","search":"'-2026':14A,17A '-91879':15A,18A '1.1.1':46B,86C '1.2.1':49B,90C '1.3.0':51B,92C 'access':68B,76B,115C,127C 'attack':62B,112C 'client':59B,106C 'code':31B 'compon':108C 'contain':94C 'could':69B,116C 'credenti':9A 'cve':13A,16A 'dell':1A,27B,39B,77C 'exploit':118C 'exposur':124C 'file':12A,57B,102C 'gain':74B 'host':36B 'inform':54B,99C,123C 'infrastructur':29B 'infrastructure-as-cod':28B 'initi':60B,107C 'insert':96C 'lead':121C 'leak':8A 'log':11A,56B,72B,101C 'low':64B,110C 'objectscal':5A,32B,44B,80C,87C 'objectscale':22A 'potenti':117C 'powerstor':7A,33B,48B,82C,93C 'powerstore':26A 'prior':84C 'privileg':65B,111C 'provid':3A,42B 'provider':21A,25A 'read':70B 'remot':67B,114C 'self':35B 'self-host':34B 'sensit':53B,98C 'terraform':2A,20A,24A,37B,41B,78C 'terraform-provider-objectscale':19A 'terraform-provider-powerstore':23A 'unauthor':75B,126C 'vendor':38B 'version':83C,89C 'vulner':103C,120C 'write':52B","nicknames":[],"mitigations":[],"who_affected":"Teams that manage Dell ObjectScale or PowerStore storage with the Dell Terraform providers. Affected: ObjectScale provider before 1.1.1 and PowerStore provider 1.2.1 through 1.3.0; sensitive information is written to logs during client initialization, so anyone who can read those logs (local, CI, shared log stores) may obtain credentials. Teams not using these providers, or on fixed versions, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T18:29:48Z","by":"analyst","doc":"https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities","run_id":3575},"products":{"at":"2026-11-11T18:29:48Z","by":"analyst","doc":"https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities","run_id":3575},"who_affected":{"at":"2026-11-11T18:29:48Z","by":"analyst","doc":"https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities","run_id":3575}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["terraformproviderobjectscale","terraformproviderpowerstore"],"ptokens":["objectscale","powerstore","provider","terraform"],"labels":["dell","high","infrastructureascode","objectscale","powerstore","selfhosted","terraform","vendor"],"campaign_type":null,"search_a":"'-2026':14A,17A '-91879':15A,18A 'credenti':9A 'cve':13A,16A 'dell':1A 'file':12A 'leak':8A 'log':11A 'objectscal':5A 'objectscale':22A 'powerstor':7A 'powerstore':26A 'provid':3A 'provider':21A,25A 'terraform':2A,20A,24A 'terraform-provider-objectscale':19A 'terraform-provider-powerstore':23A","search_b":"'1.1.1':46B '1.2.1':49B '1.3.0':51B 'access':68B,76B 'attack':62B 'client':59B 'code':31B 'could':69B 'dell':27B,39B 'file':57B 'gain':74B 'host':36B 'inform':54B 'infrastructur':29B 'infrastructure-as-cod':28B 'initi':60B 'log':56B,72B 'low':64B 'objectscal':32B,44B 'powerstor':33B,48B 'privileg':65B 'provid':42B 'read':70B 'remot':67B 'self':35B 'self-host':34B 'sensit':53B 'terraform':37B,41B 'unauthor':75B 'vendor':38B 'write':52B","search_c":"'1.1.1':86C '1.2.1':90C '1.3.0':92C 'access':115C,127C 'attack':112C 'client':106C 'compon':108C 'contain':94C 'could':116C 'dell':77C 'exploit':118C 'exposur':124C 'file':102C 'inform':99C,123C 'initi':107C 'insert':96C 'lead':121C 'log':101C 'low':110C 'objectscal':80C,87C 'potenti':117C 'powerstor':82C,93C 'prior':84C 'privileg':111C 'remot':114C 'sensit':98C 'terraform':78C 'unauthor':126C 'version':83C,89C 'vulner':103C,120C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T18:19:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91879","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91879","severity":null,"published_at":"2026-11-11T18:19:53+00:00","modified_at":"2026-11-11T18:19:53+00:00","first_seen_at":"2026-11-11T18:28:44+00:00","fetched_at":"2026-11-11T18:28:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91879:3575","url":"https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities","severity":null,"published_at":"2026-11-11T18:29:48+00:00","modified_at":"2026-11-11T18:29:48+00:00","first_seen_at":"2026-11-11T18:29:48+00:00","fetched_at":"2026-11-11T18:29:48+00:00","note":"Dell DSA-2026-433 (rev 2.0, 2026-11-06) confirms fixed versions. Advisory does not state which log settings trigger the write for this CVE; the GOPOWERSTORE_DEBUG=true workaround is listed only for sibling CVE-2026-91891, so not applied here. No exploitation or PoC found; no social search done.","cites":["https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities"]}],"documents":[{"id":127836,"url":"https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities","title":"DSA-2026-433: Security Update for Dell Terraform Provider for Dell Storage","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}