CVE-2026-91882
8.6HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-209
Impact
Remote, unauthenticated attackers can access exposed sensitive operational data. They only require network access to the externally accessible file or directory generated by the provider.
Root cause
The API client error handling component writes sensitive information directly into an externally accessible file or directory.
Affected systems
Dell Terraform Provider for OME versions 1.0.0 through 1.2.3
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Fix & remediation
Upgrade the Dell Terraform Provider for OME to a version newer than 1.2.3 per Dell advisory DSA-2026-434; as an immediate interim mitigation, restrict network access to any directories or log files exposed by the provider.
$ terraform init -upgradeAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in the API client error handling component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.