TERRAFORM-PROVIDER-POWERFLEX · CVE-2026-91880 · Infrastructure
FIX → 1.9.0 ✓ verified
The Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0, uses an SSH host key callback that accepts any server key by default. An attacker positioned on the network path can impersonate the PowerFlex system and receive the SSH connection, exposing information and enabling unauthorized access.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that use the Dell Terraform Provider for PowerFlex between versions 1.5.0 and 1.8.0 to manage PowerFlex storage through SSH. The default SSH host key callback skips verification, so the exposure applies to the default configuration. Teams not using this provider, or using versions outside that range, can skip it.
Not affected if host-key-set, version-outside-range
Who cares dell, infrastructure-as-code, powerflex, terraform
Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0, contains an Improper Certificate Validation vulnerability in the SSH client component.Terraform PowerFlex provider uses ssh.InsecureIgnoreHostKey() as the default SSH host key callback. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 1.9.0
1.9.0 or later (replaces insecure SSH host key handling with known_hosts validation)