CVE-2026-91880: High severity vulnerability
Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0, contains an Improper Certificate Validation vulnerability in the SSH client component.Terraform PowerFlex provider uses ssh.InsecureIgnoreHostKey() as the default SSH host key callback. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the default SSH host key callback so that host keys are validated rather than using ssh.InsecureIgnoreHostKey().
Terraform PowerFlex provider SSH client SSH host key callback = Host key validation instead of ssh.InsecureIgnoreHostKey()
Event History
Frequently Asked Questions
Which deployments are affected by this issue?
Dell Terraform Provider for PowerFlex versions 1.5.0 through 1.8.0 are affected. The insecure SSH host-key callback is the default behavior described for the provider's SSH client component.
What does an attacker need to exploit it?
An attacker must have remote access sufficient to interfere with or impersonate the SSH endpoint used by the provider. No authentication or user interaction is required according to the supplied vector.
What is the likely impact of successful exploitation?
Successful exploitation could expose information and enable unauthorized access. The reported impact also includes high confidentiality and integrity effects and limited availability impact.