Dell Terraform Provider for OME: API client error handling exposes sensitive information

Impact

Versions 1.0.0 through 1.2.3 of the Dell Terraform Provider for OpenManage Enterprise insert sensitive information into an externally accessible file or directory during API client error handling. Anything that leaks out of this provider leaks about the system that manages server hardware - OME drives inventory, firmware and configuration for Dell fleets, so the exposed material is management-plane detail for the nodes themselves. The record does not say exactly which values land where, and Terraform error output routinely ends up in CI logs and state artifacts that are visible more widely than the OME credentials they describe. Dell rates it 8.6 with high confidentiality impact and no authentication required.

Who can reach it

Per Dell, an unauthenticated attacker with remote access; in practice, whoever can read the files or output the provider writes during error handling - CI job logs, plan artifacts, shared runner workspaces.

What to do

Upgrade the provider past 1.2.3 per Dell advisory DSA-2026-434. This is a Terraform provider version bump in your IaC pipeline, not a server action, so there is no node downtime - but assume anything already leaked is leaked: rotate the OME credentials used by past runs and purge plan output and CI logs that may carry them.

References

Related entries

• VMware Aria Automation (SQL injection): An authenticated user injects SQL and performs unauthorized read/writeCVE-2024-22280 · VMware Aria Automation (SQL injection)High
• Juniper Security Director Policy Enforcer: unauthenticated attacker can replace vSRX images pushed to VMware NSXCVE-2025-11198 · Juniper Security Director Policy Enforcer (vSRX image upload)High
• VMware Aria Operations for Logs (credential disclosure): A View Only Admin reads the credentials of other VMwareCVE-2025-22218 · VMware Aria Operations for Logs (credential disclosure)High
• Nagios Log Server: group-writable sudo scripts let the web user replace a root script and get rootCVE-2025-34323 · Nagios Log Server (/usr/local/nagioslogserver/scripts, group-writable + passwordless sudo)High
• VMware vCenter (SMTP header injection via scheduled tasks): A non-administrative user with scheduled-task permissionsCVE-2025-41250 · VMware vCenter (SMTP header injection via scheduled tasks)High
• AMD NBIO register lock bits - System Management Network access: NBIO registers that should be locked after boot areCVE-2025-61972 · AMD NBIO register lock bits - System Management Network accessHigh