Dell Redfish Provider CVE-2026-76113

Requires an attacker with High privileges (PR:H) in the Terraform workflow plus user interaction (UI:R) - specifically the execution of a configuration using the redfish_certificate resource in the Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1. Exploitation further depends on access to where the sensitive data is exposed (Terraform debug logs, state files, or CI/CD output), per CWE-532. Limiting factors: the privileged-operator requirement, the need for the vulnerable resource to be actively used, the bounded version range, and the low confidentiality impact (C:L) constrain realistic abuse to actors already close to the automation pipeline.

This is a low-severity (CVSS 4.3) information-exposure issue (CWE-532) that is unlikely to be a patching priority for most organizations. The Dell-assigned CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) requires High privileges (PR:H) and user interaction (UI:R), both of which substantially raise the bar for abuse - exploitation presupposes an attacker who is already a privileged operator of the Terraform workflow, so the vulnerability mostly re-exposes data that such an actor could often already reach. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so there is no public exploit identified at time of analysis and no evidence of exploitation probability; this is a static severity read, not an exploitation-likelihood read. Note one internal inconsistency: the description and CWE-532 describe pure sensitive-information exposure, yet the vendor vector assigns Integrity (I:L) and Availability (A:L) impacts - a log/state-disclosure weakness would normally affect confidentiality only, so the I:L/A:L scoring should be verified against the Dell advisory (DSA-2026-434). Bottom line: genuinely low real-world risk given PR:H + UI:R and a niche IaC provider; not an urgent priority absent any exploitation signal.

A privileged user runs a Terraform plan/apply that invokes the redfish_certificate resource against a Dell server; sensitive material (e.g., certificate data) is written into Terraform debug logs or state. Another actor with access to those logs, state files, or CI/CD artifacts then reads the exposed information. No public exploit code is identified, and the network vector is gated by High privileges and required user interaction.