Database/Control plane, storage & DevOps
Dell Terraform Provider for PowerFlex: SSH host keys not verified, exposing storage credentials to MITM
Impact
By default the provider's SSH client uses ssh.InsecureIgnoreHostKey(), so it never checks which host it is talking to when it opens SSH sessions to PowerFlex systems. Anyone in the network path can pose as the storage node and capture the credentials and commands Terraform sends, or tamper with the session. The provider is used to configure software-defined block storage, which in a GPU cluster can hold dataset and checkpoint volumes shared by many tenants. Dell rates the impact as information exposure and unauthorized access.
Who can reach it
Anyone who can intercept traffic between the host running Terraform and the PowerFlex systems it manages, usually on the storage management network. No authentication is needed, only that network position.
What to do
Apply the update in Dell DSA-2026-433. The record lists versions 1.5.0 through 1.8.0 as affected but gives no fixed version, so check the advisory. This is a client-side provider upgrade on the automation host, with no storage or node downtime. Treat credentials used over unverified SSH sessions as exposed and rotate them.
References
Related entries
- Ceph CephX (authentication protocol): A tenant holding one low-privilege CephX client key ends up with cluster-wideNCVD-2025-016-ceph-cephx-authentication-protoc · Ceph CephX (authentication protocol)High
- GlusterFS (brick, server-rpc-fops.c): Multiple stack buffer overflows from fixed-size alloca() allocations in the brickCVE-2018-10907 · GlusterFS (brick, server-rpc-fops.c)High
- GlusterFS (brick, gfs3_symlink_req): Symlink creation is not confined to the volume, so a client plants a link pointingCVE-2018-10928 · GlusterFS (brick, gfs3_symlink_req)High
- NetApp Clustered Data ONTAP export policy enforcement (SMBv2/SMBv3): Export policy rules marked read-only are notCVE-2018-5490 · NetApp Clustered Data ONTAP export policy enforcement (SMBv2/SMBv3)High
- Schneider Electric Data Center Expert 7.5.0 and earlier - zip upload: A crafted zip uploaded through the DCE UI canCVE-2018-7807 · Schneider Electric Data Center Expert 7.5.0 and earlier - zip uploadHigh
- CyberPower PowerPanel Business Edition 3.4.0 Agent/Center: Cross-site request forgery across all forms in the webCVE-2019-13071 · CyberPower PowerPanel Business Edition 3.4.0 Agent/CenterHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.