CVE-2026-91882: High severity Dell Terraform Provider for OME vulnerability
Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in the API client error handling component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Dell Terraform Provider for OME versions 1.0.0 through 1.2.3 are affected. The issue is in the API client error handling component.
Does exploitation require authentication or user interaction?
No. The provided CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the likely impact of successful exploitation?
Successful exploitation could expose sensitive information by inserting it into an externally accessible file or directory. The supplied severity vector indicates high confidentiality impact, with low integrity and availability impact.