Database/Control plane, storage & DevOps
Dell Terraform Provider for PowerStore: authentication data not fully redacted in diagnostic logs
Impact
Diagnostic logs from the PowerStore provider may not fully redact authentication data. Anyone who gets those logs may recover credentials for the PowerStore array the provider manages. The record lists confidentiality impact only, with no integrity or availability impact from the flaw itself, but leaked array credentials give access to the storage behind the cluster.
Who can reach it
Dell describes an unauthenticated remote attacker. In practice the attacker has to be able to reach the diagnostic log output, for example logs shipped to a shared collector or CI artifacts.
What to do
Upgrade the Dell Terraform Provider for PowerStore to 1.3.1 or later (DSA-2026-433). This is a client-side provider upgrade with no array downtime. Purge or restrict existing diagnostic logs and rotate the PowerStore credentials the provider used.
References
Related entries
- Jenkins Script Security Plugin: approved JAR is re-downloaded, letting a second payload load into the controllerCVE-2026-92128 · Jenkins Script Security Plugin (classpath JAR double-download)High
- Jenkins Script Security Plugin: sandbox does not check dynamically added methods, allowing escapeCVE-2026-92129 · Jenkins Script Security Plugin (Groovy sandbox, runtime-added methods)High
- ntpd (transmit timestamp prediction): A remote attacker who can predict transmit timestamps can crash ntpd or, worseCVE-2020-13817 · ntpd (transmit timestamp prediction)High
- Cisco Nexus 9000 in ACI mode (fabric infrastructure VLAN): A device plugged into a normal front-panel port can talk itsCVE-2021-1228 · Cisco Nexus 9000 in ACI mode (fabric infrastructure VLAN)High
- HTCondor (daemon-to-daemon channel, negotiator/startd/schedd): Secret material crosses the network in the clear whenCVE-2021-45104 · HTCondor (daemon-to-daemon channel, negotiator/startd/schedd)High
- Harbor registry: P2P preheat execution logs readable/updatable by any authenticated user via job ID enumerationCVE-2022-31671 · Harbor registryHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.