Dell Terraform Provider CVE-2026-91882

Requires the Dell Terraform Provider for OME (v1.0.0-1.2.3) to hit an API client error path, after which sensitive information is written into an externally-accessible file or location (consistent with CWE-209 - error output such as logs, Terraform state, or debug artifacts). Realistic exploitation is LIMITED by the attacker needing read access to wherever that error output is stored; the provider is operator-run IaC tooling, so exposure typically depends on shared log aggregation, publicly-readable CI/CD output, or state files rather than a directly network-exposed service. The vendor's AV:N/PR:N vector is not clearly supported by the described file-insertion mechanism and should be verified against Dell DSA-2026-434.

Dell rates this CVSS 3.1 8.6 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, implying remote, unauthenticated, low-complexity exploitation with high confidentiality impact. However, the signals conflict with the described mechanism: the flaw is CWE-209 (sensitive information in error handling) that inserts data 'into an externally-accessible file or directory' - a disclosure primitive that in practice depends on an attacker being able to read that file (logs, Terraform state, or a debug artifact produced by the provider), which is characteristically a local/post-compromise condition rather than a clean network-reachable service. The I:L and A:L sub-scores are also hard to reconcile with a pure information-exposure weakness, which normally carries no integrity or availability impact; this suggests the vendor vector may be padded or reflects a broader advisory. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of real-world exploitation - this is a vendor-disclosed issue, not an actively-attacked one. Net: treat as a moderate, patch-on-normal-cycle issue for the small population running the affected provider, NOT an emergency. Verify the true attack vector (network vs. local file read) with Dell advisory DSA-2026-434 before accepting the AV:N/PR:N framing.

The Dell Terraform Provider for OME, while managing OpenManage Enterprise, encounters an API client error whose handler writes sensitive details (e.g., credentials, tokens, or internal endpoint data) into an error message or file that is accessible beyond the intended trust boundary. An attacker who can reach that artifact - a shared log store, exported state, or CI output - reads the leaked secrets and reuses them. No public exploit identified at time of analysis; exploitation requires access to the location where the error output lands.