Dell Terraform Provider for PowerFlex: Improper SSH Certificate Validation (CVE-2026-91880)
The Dell Terraform Provider for PowerFlex versions 1.5.0 through 1.8.0 contains an Improper Certificate Validation vulnerability in the SSH client component that could lead to information exposure and unauthorized access.
CVE search metadata
CVE search record: CVE-2026-91880. Severity: high. CVSS: 8.9. KEV: no. Product: Terraform Provider for PowerFlex (1.5.0-1.8.0). Brief: Dell Terraform Provider for PowerFlex: Improper SSH Certificate Validation (CVE-2026-91880). Brief link: https://feed.craftedsignal.io/briefs/2026-11-dell-terraform-powerflex-ssh-cve-2026-91880/
Triage facts
Revision 1- Applicability
- Terraform Provider for PowerFlex (1.5.0-1.8.0)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 20:11 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0, contains an Improper Certificate Validation vulnerability in the SSH client component. The provider uses ssh.InsecureIgnoreHostKey() as the default SSH host key callback. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.
Impact
Successful exploitation could result in information exposure and unauthorized access.
Recommendation
Users should monitor for vendor guidance regarding this vulnerability.