Terraform Provider for PowerStore (< 1.3.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/terraform-provider-for-powerstore--1.3.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 20:11:54 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDell Terraform Provider for PowerStore: Information exposure in diagnostic logs (CVE-2026-91891)https://feed.craftedsignal.io/briefs/2026-11-dell-terraform-provider-powerstore-log-exposure-cve-2026-91891/Wed, 11 Nov 2026 20:11:54 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-dell-terraform-provider-powerstore-log-exposure-cve-2026-91891/Dell Terraform Provider for PowerStore versions prior to 1.3.1 are vulnerable to information exposure, as the provider fails to sufficiently redact sensitive authentication credentials in diagnostic logs.Dell Terraform Provider for PowerStore versions prior to 1.3.1 contains a vulnerability that results in the insufficient redaction of sensitive authentication data within diagnostic logs. An unauthenticated attacker with remote access to these logs could potentially retrieve sensitive credentials, leading to information exposure.

Impact

Successful exploitation may lead to the disclosure of sensitive authentication credentials, which could be utilized by an attacker for unauthorized access to systems managed by the affected Terraform provider.

Recommendation

Upgrade the Dell Terraform Provider for PowerStore to version 1.3.1 or later to ensure that authentication data is properly redacted in diagnostic logs. Additionally, review existing diagnostic log files for evidence of exposed credentials and consider rotating any sensitive information that may have been logged prior to the upgrade.

]]>highadvisory