---
id: "CVE-2026-91880"
page: "https://infrastack.ai/live/CVE-2026-91880"
kind: "vulnerability"
aliases: ["CVE-2026-91880"]
title: "Dell Terraform Provider for PowerFlex skips SSH host key checks, enabling impersonation"
severity: "high"
cvss: 8.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "terraform-provider-powerflex", "fixed": ["1.9.0"], "affected": ">= 1.5.0, <= 1.8.0", "ecosystem": "terraform"}]
ecosystems: []
tags: ["dell", "infrastructure", "infrastructure-as-code", "powerflex", "terraform"]
not_affected_if: ["host-key-set", "version-outside-range"]
published_at: "2026-11-11T19:17:48+00:00"
first_seen_at: "2026-11-11T19:28:49+00:00"
updated_at: "2026-11-11T19:30:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91880", "first_seen_at": "2026-11-11T19:28:49+00:00"}, {"source": "analyst", "url": "https://www.dell.com/support/kbdoc/en-us/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities", "first_seen_at": "2026-11-11T19:30:57+00:00", "cites": ["https://www.dell.com/support/kbdoc/en-us/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities", "https://github.com/dell/terraform-provider-powerflex/releases"]}]
exploit_sources: []
---

# Dell Terraform Provider for PowerFlex skips SSH host key checks, enabling impersonation

Link for people: https://infrastack.ai/live/CVE-2026-91880 (this .md is for agents)

The Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0, uses an SSH host key callback that accepts any server key by default. An attacker positioned on the network path can impersonate the PowerFlex system and receive the SSH connection, exposing information and enabling unauthorized access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- terraform:terraform-provider-powerflex affected >= 1.5.0, <= 1.8.0 fixed 1.9.0

## How to check

- Check .terraform.lock.hcl (or required_providers) for dell/powerflex versions 1.5.0 through 1.8.0.
- Check whether your configuration makes the provider connect to PowerFlex hosts over SSH and whether host_key is set explicitly; if not, host keys are not verified.

## Fix

Upgrade dell/powerflex Terraform provider to 1.9.0 or later (replaces insecure SSH host key handling with known_hosts validation). Workaround until upgrade: explicitly set the host_key parameter in your Terraform resources.

## Timeline

- 2026-11-11T19:28:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91880
- 2026-11-11T19:30:57+00:00 analyst https://www.dell.com/support/kbdoc/en-us/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities — Dell DSA-2026-433 (rev 2.0, 2026-11-06) confirms affected 1.5.0-1.8.0, fixed 1.9.0 (release notes: known_hosts-based SSH host key validation); workaround host_key param. No exploitation or PoC seen; social search skipped.

## Documents

- [advisory] DSA-2026-433 Dell Terraform Provider https://www.dell.com/support/kbdoc/en-us/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities
- [fix] terraform-provider-powerflex v1.9.0 release notes https://github.com/dell/terraform-provider-powerflex/releases

## From the sources

Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0, contains an Improper Certificate Validation vulnerability in the SSH client component.Terraform PowerFlex provider uses ssh.InsecureIgnoreHostKey() as the default SSH host key callback. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_