Dell Terraform Providers for ObjectScale and PowerStore: client initialization writes sensitive data to logs

Impact

The providers' client initialization code writes sensitive information into log files. The record does not say exactly what is logged, but the scoring (high confidentiality, integrity and availability impact) and Dell's wording point to credentials for the managed ObjectScale object store or PowerStore array. Anyone who can read the Terraform logs, or a CI system that collects them, could reuse those credentials against storage that may hold shared training data and checkpoints.

Who can reach it

A low-privileged user with remote access who can read the provider's log output, for example on a shared automation host or in CI job logs. Authentication at a low privilege level is required.

What to do

Upgrade the ObjectScale provider to 1.1.1 or later. For PowerStore, versions 1.2.1 through 1.3.0 are affected; take the fixed release from Dell DSA-2026-433. This is a client-side provider upgrade with no storage downtime. Purge existing Terraform and CI logs that may contain the data, and rotate the storage credentials the providers used.

References

Related entries

• Jenkins Script Security Plugin: four Groovy sandbox escapes give code execution on the controllerCVE-2026-92122 · Jenkins Script Security Plugin (Groovy sandbox)High
• Jenkins Robot Framework Plugin: archive path escapes the build directory, allowing arbitrary file writeCVE-2026-92137 · Jenkins Robot Framework Plugin (report archive directory)High
• KubeEdge (ConfigUpdateJob handler, updateFields): REMOTE CODE EXECUTION ON EDGE NODES via a normal Kubernetes APINCVD-2026-051-kubeedge-configupdatejob-handler · KubeEdge (ConfigUpdateJob handler, updateFields)High
• KubeEdge (NodeUpgradeJob handler, v1alpha2 API): REMOTE CODE EXECUTION ON EDGE NODES through the upgrade path. TheNCVD-2026-052-kubeedge-nodeupgradejob-handler · KubeEdge (NodeUpgradeJob handler, v1alpha2 API)High
• APC Network Management Card 4 (NMC4): An unauthenticated attacker can manipulate URL parameters to walk out of the webCVE-2024-58310 · APC Network Management Card 4 (NMC4)High
• GitLab CE/EE: malicious wiki content can drive unauthorized actions as another userCVE-2025-12716 · GitLab CE/EE (wiki page content handling)High