Dell Ansible Storage for PowerStore: API client skips certificate validation, exposing credentials to MITM

Impact

The API client in Dell's Ansible collection for PowerStore does not validate TLS certificates properly. Anyone in the network path can pose as the PowerStore array, capture the credentials the playbooks send, and alter the API traffic. Those credentials give management access to the array and the volumes or file shares it serves to the cluster.

Who can reach it

Anyone who can intercept traffic between the Ansible control node and the PowerStore API, usually on the storage management network. No authentication is needed, only that network position.

What to do

Upgrade the Dell Ansible Storage for PowerStore collection to 3.9.0 or later (DSA-2026-431). This is an upgrade on the Ansible control node with no array downtime. Rotate the PowerStore credentials used over unverified connections.

References

Related entries

• Sigstore cosign (verify-blob / verify-blob-attestation, legacy JSON bundle): SUPPLY CHAIN, VERIFICATION BYPASS: keylessNCVD-2026-056-sigstore-cosign-verify-blob-veri · Sigstore cosign (verify-blob / verify-blob-attestation, legacy JSON bundle)High
• Grafana: Stored XSS via Unified AlertingCVE-2022-31097 · GrafanaHigh
• Linux i915 GVT-g mediated GPU virtualisation (debugfs teardown): Companion to the vGPU debugfs cleanup bug: GVT-gCVE-2023-54098 · Linux i915 GVT-g mediated GPU virtualisation (debugfs teardown)High
• HPE Insight Remote Support: XML external entity injection allows remote disclosure of server informationCVE-2024-11622 · HPE Insight Remote Support (XXE)High
• AMD Optimizing CPU Libraries (AOCL) - installation directory permissions: AOCL installs with permissive directoryCVE-2024-21960 · AMD Optimizing CPU Libraries (AOCL) - installation directory permissionsHigh
• Intel Data Center GPU Flex Series - Windows driver: Improper buffer restrictions in the Flex Series Windows driver letCVE-2024-36292 · Intel Data Center GPU Flex Series - Windows driverHigh