{"id":"CVE-2026-91880","kind":"vulnerability","aliases":["CVE-2026-91880"],"related":[],"title":"Dell Terraform Provider for PowerFlex skips SSH host key checks, enabling impersonation","description":"Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0, contains an Improper Certificate Validation vulnerability in the SSH client component.Terraform PowerFlex provider uses ssh.InsecureIgnoreHostKey() as the default SSH host key callback. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.","summary":"The Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0, uses an SSH host key callback that accepts any server key by default. An attacker positioned on the network path can impersonate the PowerFlex system and receive the SSH connection, exposing information and enabling unauthorized access.","severity":"high","cvss":8.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"terraform-provider-powerflex","fixed":["1.9.0"],"affected":">= 1.5.0, <= 1.8.0","ecosystem":"terraform"}],"ecosystems":[],"tags":["dell","infrastructure","infrastructure-as-code","powerflex","terraform"],"not_affected_if":["host-key-set","version-outside-range"],"how_to_check":"- Check .terraform.lock.hcl (or required_providers) for dell/powerflex versions 1.5.0 through 1.8.0.\n- Check whether your configuration makes the provider connect to PowerFlex hosts over SSH and whether host_key is set explicitly; if not, host keys are not verified.","fix":"Upgrade dell/powerflex Terraform provider to 1.9.0 or later (replaces insecure SSH host key handling with known_hosts validation). Workaround until upgrade: explicitly set the host_key parameter in your Terraform resources.","status":"open","published_at":"2026-11-11T19:17:48+00:00","first_seen_at":"2026-11-11T19:28:49+00:00","triaged_at":"2026-11-11T19:29:42+00:00","updated_at":"2026-11-11T19:30:57+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-11T19:29:42Z","model":"claude-haiku-5-5","output":{"fix":"- Dell Terraform Provider for PowerFlex: fixed version unknown from the sources","reach":"network","title":"Dell Terraform Provider for PowerFlex skips SSH host key checks, enabling impersonation","impact":"high","summary":"The Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0, uses an SSH host key callback that accepts any server key by default. An attacker positioned on the network path can impersonate the PowerFlex system and receive the SSH connection, exposing information and enabling unauthorized access.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["terraform","powerflex","dell","infrastructure-as-code"],"confidence":0.7,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker impersonates the storage system and captures SSH sessions","analyst_note":"Confirm the fixed version and any Dell advisory for CVE-2026-91880; sources give only the NVD description and CVSS 8.9.","how_to_check":"- Check the provider version in the Terraform configuration or `.terraform.lock.hcl` for `dell/powerflex` versions between `1.5.0` and `1.8.0`\n- Check whether the provider is configured to connect to PowerFlex hosts over SSH","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams that use the Dell Terraform Provider for PowerFlex between versions 1.5.0 and 1.8.0 to manage PowerFlex storage through SSH. The default SSH host key callback skips verification, so the exposure applies to the default configuration. Teams not using this provider, or using versions outside that range, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000784,"input_tokens":4611,"output_tokens":645,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any Dell advisory for CVE-2026-91880; sources give only the NVD description and CVSS 8.9.","search":"'-2026':14A,17A '-91880':15A,18A '1.5.0':38B,83C '1.8.0':40B,85C 'accept':48B 'access':76B,113C,125C 'attack':55B,110C 'callback':46B,107C 'certif':89C 'check':10A 'client':95C 'code':28B 'component.terraform':96C 'connect':70B 'contain':86C 'could':114C 'cve':13A,16A 'default':53B,103C 'dell':1A,23B,32B,77C 'enabl':11A,74B 'exploit':116C 'expos':71B 'exposur':122C 'host':8A,44B,105C 'imperson':12A,62B 'improp':88C 'inform':72B,121C 'infrastructur':24B,26B 'infrastructure-as-cod':25B 'key':9A,45B,51B,106C 'lead':119C 'network':59B 'path':60B 'posit':56B 'potenti':115C 'powerflex':5A,22A,29B,36B,64B,81C,97C 'provid':3A,34B,79C,98C 'provider':21A 'receiv':67B 'remot':112C 'server':50B 'skip':6A 'ssh':7A,43B,69B,94C,104C 'ssh.insecureignorehostkey':100C 'system':65B 'terraform':2A,20A,30B,33B,78C 'terraform-provider-powerflex':19A 'unauthent':109C 'unauthor':75B,124C 'use':41B,99C 'valid':90C 'version':37B,82C 'vulner':91C,118C","nicknames":[],"mitigations":[],"who_affected":"Teams that use the Dell Terraform Provider for PowerFlex between versions 1.5.0 and 1.8.0 to manage PowerFlex storage through SSH. The default SSH host key callback skips verification, so the exposure applies to the default configuration. Teams not using this provider, or using versions outside that range, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T19:30:57Z","by":"analyst","doc":"https://github.com/dell/terraform-provider-powerflex/releases","run_id":3580},"products":{"at":"2026-11-11T19:30:57Z","by":"analyst","doc":"https://github.com/dell/terraform-provider-powerflex/releases","run_id":3580},"workarounds":{"at":"2026-11-11T19:30:57Z","by":"analyst","doc":"https://github.com/dell/terraform-provider-powerflex/releases","run_id":3580},"how_to_check":{"at":"2026-11-11T19:30:57Z","by":"analyst","doc":"https://github.com/dell/terraform-provider-powerflex/releases","run_id":3580},"who_affected":{"at":"2026-11-11T19:30:57Z","by":"analyst","doc":"https://github.com/dell/terraform-provider-powerflex/releases","run_id":3580}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["terraformproviderpowerflex"],"ptokens":["powerflex","provider","terraform"],"labels":["dell","high","infrastructure","infrastructureascode","powerflex","terraform"],"campaign_type":null,"search_a":"'-2026':14A,17A '-91880':15A,18A 'check':10A 'cve':13A,16A 'dell':1A 'enabl':11A 'host':8A 'imperson':12A 'key':9A 'powerflex':5A,22A 'provid':3A 'provider':21A 'skip':6A 'ssh':7A 'terraform':2A,20A 'terraform-provider-powerflex':19A","search_b":"'1.5.0':38B '1.8.0':40B 'accept':48B 'access':76B 'attack':55B 'callback':46B 'code':28B 'connect':70B 'default':53B 'dell':23B,32B 'enabl':74B 'expos':71B 'host':44B 'imperson':62B 'inform':72B 'infrastructur':24B,26B 'infrastructure-as-cod':25B 'key':45B,51B 'network':59B 'path':60B 'posit':56B 'powerflex':29B,36B,64B 'provid':34B 'receiv':67B 'server':50B 'ssh':43B,69B 'system':65B 'terraform':30B,33B 'unauthor':75B 'use':41B 'version':37B","search_c":"'1.5.0':83C '1.8.0':85C 'access':113C,125C 'attack':110C 'callback':107C 'certif':89C 'client':95C 'component.terraform':96C 'contain':86C 'could':114C 'default':103C 'dell':77C 'exploit':116C 'exposur':122C 'host':105C 'improp':88C 'inform':121C 'key':106C 'lead':119C 'potenti':115C 'powerflex':81C,97C 'provid':79C,98C 'remot':112C 'ssh':94C,104C 'ssh.insecureignorehostkey':100C 'terraform':78C 'unauthent':109C 'unauthor':124C 'use':99C 'valid':90C 'version':82C 'vulner':91C,118C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91880","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91880","severity":null,"published_at":"2026-11-11T19:17:48+00:00","modified_at":"2026-11-11T19:17:48+00:00","first_seen_at":"2026-11-11T19:28:49+00:00","fetched_at":"2026-11-11T19:28:49+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91880:3580","url":"https://www.dell.com/support/kbdoc/en-us/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities","severity":null,"published_at":"2026-11-11T19:30:57+00:00","modified_at":"2026-11-11T19:30:57+00:00","first_seen_at":"2026-11-11T19:30:57+00:00","fetched_at":"2026-11-11T19:30:57+00:00","note":"Dell DSA-2026-433 (rev 2.0, 2026-11-06) confirms affected 1.5.0-1.8.0, fixed 1.9.0 (release notes: known_hosts-based SSH host key validation); workaround host_key param. No exploitation or PoC seen; social search skipped.","cites":["https://www.dell.com/support/kbdoc/en-us/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities","https://github.com/dell/terraform-provider-powerflex/releases"]}],"documents":[{"id":128311,"url":"https://www.dell.com/support/kbdoc/en-us/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities","title":"DSA-2026-433 Dell Terraform Provider","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":128313,"url":"https://github.com/dell/terraform-provider-powerflex/releases","title":"terraform-provider-powerflex v1.9.0 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}