{"id":"CVE-2026-91891","kind":"vulnerability","aliases":["CVE-2026-91891"],"related":[],"title":"Dell Terraform Provider for PowerStore leaks authentication data in diagnostic logs","description":"Dell Terraform Provider for PowerStore, versions prior to 1.3.1 , contains a  vulnerability that may cause sensitive authentication data to be insufficiently redacted in diagnostic logs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.","summary":"The Dell Terraform Provider for PowerStore, before version 1.3.1, does not fully redact sensitive authentication data written to its diagnostic logs. An unauthenticated remote attacker who can reach those logs could read the exposed credentials.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dell-powerstore","infrastructure-as-code","terraform","vendor"],"not_affected_if":["version-1.3.1-or-later"],"how_to_check":"- Check the installed provider version in the Terraform configuration or lock file (`.terraform.lock.hcl`) for the Dell PowerStore provider.\n- Look for diagnostic or debug log output from the provider and confirm whether it contains authentication values.","fix":null,"status":"open","published_at":"2026-11-11T19:17:48+00:00","first_seen_at":"2026-11-11T19:28:50+00:00","triaged_at":"2026-11-11T19:30:03+00:00","updated_at":"2026-11-11T19:30:03+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-11T19:30:03Z","model":"claude-haiku-5-5","output":{"fix":"- Dell PowerStore Terraform Provider: move to `1.3.1` or later.","reach":"network","title":"Dell Terraform Provider for PowerStore leaks authentication data in diagnostic logs","impact":"medium","summary":"The Dell Terraform Provider for PowerStore, before version 1.3.1, does not fully redact sensitive authentication data written to its diagnostic logs. An unauthenticated remote attacker who can reach those logs could read the exposed credentials.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["terraform","dell-powerstore","infrastructure-as-code"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"authentication credentials readable from diagnostic log output","analyst_note":"","how_to_check":"- Check the installed provider version in the Terraform configuration or lock file (`.terraform.lock.hcl`) for the Dell PowerStore provider.\n- Look for diagnostic or debug log output from the provider and confirm whether it contains authentication values.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-1.3.1-or-later"],"who_is_affected":"Teams that run the Dell Terraform Provider for PowerStore at a version earlier than 1.3.1 are affected, particularly where provider diagnostic logs are stored or shared. Teams not using this provider, or already on 1.3.1 or later, can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000739,"input_tokens":4568,"output_tokens":565,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91891':14A,17A '1.3.1':35B,70C 'access':92C 'attack':51B,89C 'authent':7A,41B,78C 'caus':76C 'code':24B 'contain':71C 'could':57B,93C 'credenti':61B 'cve':12A,15A 'data':8A,42B,79C 'dell':1A,19B,28B,62C 'dell-powerstor':18B 'diagnost':10A,46B,85C 'exploit':95C 'expos':60B 'exposur':101C 'fulli':38B 'inform':100C 'infrastructur':22B 'infrastructure-as-cod':21B 'insuffici':82C 'lead':98C 'leak':6A 'log':11A,47B,56B,86C 'may':75C 'potenti':94C 'powerstor':5A,20B,32B,66C 'prior':68C 'provid':3A,30B,64C 'reach':54B 'read':58B 'redact':39B,83C 'remot':50B,91C 'sensit':40B,77C 'terraform':2A,25B,29B,63C 'unauthent':49B,88C 'vendor':26B 'version':34B,67C 'vulner':73C,97C 'written':43B","nicknames":[],"mitigations":[],"who_affected":"Teams that run the Dell Terraform Provider for PowerStore at a version earlier than 1.3.1 are affected, particularly where provider diagnostic logs are stored or shared. Teams not using this provider, or already on 1.3.1 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dellpowerstore","high","infrastructureascode","terraform","vendor"],"campaign_type":null,"search_a":"'-2026':13A,16A '-91891':14A,17A 'authent':7A 'cve':12A,15A 'data':8A 'dell':1A 'diagnost':10A 'leak':6A 'log':11A 'powerstor':5A 'provid':3A 'terraform':2A","search_b":"'1.3.1':35B 'attack':51B 'authent':41B 'code':24B 'could':57B 'credenti':61B 'data':42B 'dell':19B,28B 'dell-powerstor':18B 'diagnost':46B 'expos':60B 'fulli':38B 'infrastructur':22B 'infrastructure-as-cod':21B 'log':47B,56B 'powerstor':20B,32B 'provid':30B 'reach':54B 'read':58B 'redact':39B 'remot':50B 'sensit':40B 'terraform':25B,29B 'unauthent':49B 'vendor':26B 'version':34B 'written':43B","search_c":"'1.3.1':70C 'access':92C 'attack':89C 'authent':78C 'caus':76C 'contain':71C 'could':93C 'data':79C 'dell':62C 'diagnost':85C 'exploit':95C 'exposur':101C 'inform':100C 'insuffici':82C 'lead':98C 'log':86C 'may':75C 'potenti':94C 'powerstor':66C 'prior':68C 'provid':64C 'redact':83C 'remot':91C 'sensit':77C 'terraform':63C 'unauthent':88C 'version':67C 'vulner':73C,97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91891","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91891","severity":null,"published_at":"2026-11-11T19:17:48+00:00","modified_at":"2026-11-11T19:17:48+00:00","first_seen_at":"2026-11-11T19:28:50+00:00","fetched_at":"2026-11-11T19:28:50+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}