Dell Terraform Provider for PowerStore: Information exposure in diagnostic logs (CVE-2026-91891)

Dell Terraform Provider for PowerStore versions prior to 1.3.1 contains a vulnerability that results in the insufficient redaction of sensitive authentication data within diagnostic logs. An unauthenticated attacker with remote access to these logs could potentially retrieve sensitive credentials, leading to information exposure.

Impact

Successful exploitation may lead to the disclosure of sensitive authentication credentials, which could be utilized by an attacker for unauthorized access to systems managed by the affected Terraform provider.

Recommendation

Upgrade the Dell Terraform Provider for PowerStore to version 1.3.1 or later to ensure that authentication data is properly redacted in diagnostic logs. Additionally, review existing diagnostic log files for evidence of exposed credentials and consider rotating any sensitive information that may have been logged prior to the upgrade.