Dell Ansible Storage for PowerFlex: API client skips certificate validation, exposing credentials to MITM

Impact

The API client in Dell's Ansible collection for PowerFlex does not validate TLS certificates properly. Anyone in the network path can pose as the PowerFlex gateway, capture the credentials the playbooks send, and alter the API traffic. PowerFlex is software-defined block storage that can back shared volumes in a GPU cluster.

Who can reach it

Anyone who can intercept traffic between the Ansible control node and the PowerFlex API, usually on the storage management network. No authentication is needed, only that network position.

What to do

Upgrade the Dell Ansible Storage for PowerFlex collection to 3.2.0 or later (DSA-2026-431). This is an upgrade on the Ansible control node with no storage downtime. Rotate the PowerFlex credentials used over unverified connections.

References

Related entries

• Dell Ansible Storage for PowerStore: API client skips certificate validation, exposing credentials to MITMCVE-2026-91871 · Dell Ansible Storage for PowerStore (API client TLS certificate validation)High
• Sigstore cosign (verify-blob / verify-blob-attestation, legacy JSON bundle): SUPPLY CHAIN, VERIFICATION BYPASS: keylessNCVD-2026-056-sigstore-cosign-verify-blob-veri · Sigstore cosign (verify-blob / verify-blob-attestation, legacy JSON bundle)High
• Grafana: Stored XSS via Unified AlertingCVE-2022-31097 · GrafanaHigh
• Linux i915 GVT-g mediated GPU virtualisation (debugfs teardown): Companion to the vGPU debugfs cleanup bug: GVT-gCVE-2023-54098 · Linux i915 GVT-g mediated GPU virtualisation (debugfs teardown)High
• HPE Insight Remote Support: XML external entity injection allows remote disclosure of server informationCVE-2024-11622 · HPE Insight Remote Support (XXE)High
• AMD Optimizing CPU Libraries (AOCL) - installation directory permissions: AOCL installs with permissive directoryCVE-2024-21960 · AMD Optimizing CPU Libraries (AOCL) - installation directory permissionsHigh