CVE-2026-91882 in Terraform Provider for OME
Summary
by MITRE • 10/14/2026
Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in the API client error handling component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The Dell Terraform Provider for OpenManage Enterprise (OME), specifically within versions 1.0.0 through 1.2.3, suffers from a critical security flaw classified as an Insertion of Sensitive Information into Externally-Accessible File or Directory. This vulnerability resides in the API client error handling component, which is responsible for processing and logging responses from the OME management interface during infrastructure provisioning operations. The core technical issue stems from improper sanitization of error messages generated by the backend systems before they are written to local log files or configuration artifacts accessible on the host machine running Terraform. When an operation fails due to authentication errors, network timeouts, or invalid credentials provided in the Terraform configuration, the provider captures these raw error responses and writes them directly to disk without filtering out sensitive data such as API keys, session tokens, internal IP addresses, or detailed stack traces that may reveal system architecture details.
This flaw allows an unauthenticated attacker with remote access to potentially exploit this misconfiguration for information exposure purposes. Although the vulnerability is triggered during normal provider operation, it requires a specific sequence of events where the Terraform process executes commands against the OME API and encounters errors containing sensitive payloads. If the local file system permissions on the machine running the Terraform provider are not strictly restricted to the executing user, or if an attacker gains any level of access to that environment through lateral movement or other initial compromise vectors, they can read these log files. The exposed information serves as a valuable reconnaissance tool, enabling attackers to map internal network structures, identify valid credentials for further exploitation, and understand the specific versioning and configuration of the Dell management infrastructure, thereby lowering the barrier for subsequent attacks such as privilege escalation or targeted ransomware deployment.
From an industry standard perspective, this vulnerability aligns with CWE-209: Generation of Error Message Containing Sensitive Information and CWE-538: Insertion of Sensitive Information into Externally Accessible File. It also relates to ATT&CK technique T1078: Valid Accounts if the exposed credentials are leveraged, or more broadly to information gathering phases where attackers seek to understand the target environment before executing malicious actions. The lack of input validation and output encoding in the error handling routine represents a fundamental deviation from secure coding practices recommended by OWASP for API clients and infrastructure-as-code tools.
To mitigate this risk, immediate remediation is required by upgrading the Dell Terraform Provider for OME to version 1.2.4 or later, where these logging mechanisms have been hardened to exclude sensitive data from error outputs. In environments where an upgrade cannot be performed immediately, administrators should implement strict file system permissions on directories containing Terraform logs and state files, ensuring that only authorized service accounts can read them. Additionally, integrating external log management solutions with redaction capabilities or configuring the provider to use less verbose logging modes during non-debug operations can significantly reduce the attack surface. Regular auditing of log contents for accidental data leakage should also be incorporated into security monitoring workflows to detect any potential exploitation attempts early in the kill chain.