---
id: "CVE-2026-91879"
page: "https://infrastack.ai/live/CVE-2026-91879"
kind: "vulnerability"
aliases: ["CVE-2026-91879"]
title: "Dell Terraform providers for ObjectScale and PowerStore leak credentials into log files"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "terraform-provider-objectscale", "fixed": ["1.1.1"], "affected": "< 1.1.1", "ecosystem": "vendor"}, {"name": "terraform-provider-powerstore", "fixed": ["1.3.1"], "affected": ">= 1.2.1, <= 1.3.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["dell", "infrastructure-as-code", "objectscale", "powerstore", "self-hosted", "terraform", "vendor"]
not_affected_if: ["not-using-dell-terraform-providers", "provider-version-fixed"]
published_at: "2026-11-11T18:19:53+00:00"
first_seen_at: "2026-11-11T18:28:44+00:00"
updated_at: "2026-11-11T18:29:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91879", "first_seen_at": "2026-11-11T18:28:44+00:00"}, {"source": "analyst", "url": "https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities", "first_seen_at": "2026-11-11T18:29:48+00:00", "cites": ["https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities"]}]
exploit_sources: []
---

# Dell Terraform providers for ObjectScale and PowerStore leak credentials into log files

Link for people: https://infrastack.ai/live/CVE-2026-91879 (this .md is for agents)

Dell's Terraform providers for ObjectScale (before 1.1.1) and PowerStore (1.2.1 through 1.3.0) write sensitive information into log files during client initialization. An attacker with low privileges and remote access could read those logs and gain unauthorized access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:terraform-provider-objectscale affected < 1.1.1 fixed 1.1.1
- vendor:terraform-provider-powerstore affected >= 1.2.1, <= 1.3.0 fixed 1.3.1

## How to check

Find the dell objectscale and powerstore providers in required_providers and .terraform.lock.hcl (or run 'terraform providers'). Exposed if ObjectScale is below 1.1.1 or PowerStore is 1.2.1 through 1.3.0. Then review existing Terraform logs and CI output from runs using those versions for credentials/tokens and rotate any found. Dell does not say which log settings trigger the write for this CVE.

## Fix

Upgrade Terraform Provider for ObjectScale to 1.1.1 or later; Terraform Provider for PowerStore to 1.3.1 or later (Dell DSA-2026-433).

## Timeline

- 2026-11-11T18:28:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91879
- 2026-11-11T18:29:48+00:00 analyst https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities — Dell DSA-2026-433 (rev 2.0, 2026-11-06) confirms fixed versions. Advisory does not state which log settings trigger the write for this CVE; the GOPOWERSTORE_DEBUG=true workaround is listed only for sibling CVE-2026-91891, so not applied here. No exploitation or PoC found; no social search done.

## Documents

- [advisory] DSA-2026-433: Security Update for Dell Terraform Provider for Dell Storage https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities

## From the sources

Dell Terraform for ObjectScale and Powerstore, versions prior to 1.1.1 (ObjectScale) and versions 1.2.1 through 1.3.0 (PowerStore) contains an insertion of sensitive information into Log File vulnerability in the client initialization component.  A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_