EUVD-2026-101161
GHSA-jmv9-63fv-3xc9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low privileges
-
ExploitAccess provider configuration log output
-
ImpactExtract exposed sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A09:2025 - Security Logging & Alerting Failures
ASVS 5.0
V16 - Security Logging and Error Handling Log data sanitization
|
| Exploitation Conditions | Exploitation requires that the Dell Terraform Provider for OME (versions 1.0.0-1.2.3) be running and that its provider configuration component emit sensitive information into log files (CWE-532), plus an attacker who holds low-level privileges (PR:L) and can read those logs. Limiting factors: authentication is required (not an unauthenticated flaw), impact is confined to limited confidentiality (C:L) with no integrity or availability effect, and value depends on the sensitivity of what is actually logged and on the attacker's ability to reach the log destination; environments that restrict log-file access or run patched versions are not exposed. |
| Impact | This is a genuinely low-priority issue consistent with its 4.3 (Medium) CVSS score. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates network reach with low complexity but requires low-level privileges (PR:L) and yields only limited confidentiality impact (C:L) with no integrity or availability effect - a pure information-disclosure weakness (CWE-532, sensitive data in log files). No EPSS score, CISA KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation would be opportunistic rather than widespread. Signals are internally consistent - there is no CVSS-versus-description conflict here - but two caveats apply: the description says 'remote access' while CWE-532 disclosure typically also presumes the attacker can reach the log sink, and the actual sensitivity of the logged data (e.g., API tokens/credentials for OpenManage Enterprise) is not spelled out in the provided data, which could raise downstream impact if those secrets enable lateral movement. Overall this is a hardening-grade defect, not an emergency. |
| Exploit ScenarioDerived | A user with low privileges and network access to the system running Dell's Terraform Provider for OME reads the provider's log output and recovers sensitive information (such as configuration secrets or credentials) that the provider configuration component writes there during Terraform operations. No public exploit code is available; exploitation simply requires access to the logs produced in affected versions 1.0.0 through 1.2.3. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Dell Terraform Provider for OME versions 1.0.0 through 1.2.3 inserts sensitive provider configuration data into log files, so an authenticated, low-privileged remote attacker who can read those logs may obtain limited confidential information about the managed environment. Scored 4.3 (Medium) as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, the issue requires prior low-level access plus reachability of the log destination, with no integrity or availability impact. No public exploit code has been identified at time of analysis, and no confirmed active exploitation is reported, so practical risk is governed by what the provider actually writes to logs and how tightly log retention and access are controlled.
RemediationAI
Upgrade the Dell Terraform Provider for OME to a release newer than 1.2.3 as directed by Dell security advisory DSA-2026-434 (https://www.dell.com/support/kbdoc/en-in/000515444/dsa-2026-434-security-update-for-dell-terraform-provider-for-dell-server-multiple-vulnerabilities); patch availability is confirmed by this vendor security update, but the exact fixed version number is not stated in the available data, so pin the newest published release and refresh .terraform.lock.hcl accordingly. Until the upgrade is deployed, stop exposing provider configuration to log sinks: avoid running the provider with TF_LOG=DEBUG or TRACE, disable verbose/diagnostic output in CI jobs that handle OME credentials, and scrub pipeline logs so provider config is not persisted - the trade-off is reduced troubleshooting detail during incident response. Move OME credentials out of plaintext .tfvars into environment variables or a secrets manager and inject them at runtime, restrict filesystem permissions and retention on any terraform.log, and tighten read access to the log aggregation platform, since any user who can already read those logs is the threat actor here. Treat previously written logs as potentially compromised: rotate the OME service account password or API/session tokens used by the provider and review OME audit logs for anomalous API activity originating from that account. Where logging cannot be disabled, insert a redaction step or a log-forwarding filter that drops provider configuration lines before they leave the runner; this adds pipeline complexity and can mask other diagnostics but directly blocks the disclosure path.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the configuration layer of the Dell Terraform Provider for OpenManage Enterprise (OME), the HashiCorp Terraform plugin used to declare and manage Dell server infrastructure through the OME API. Provider configuration blocks typically carry the OME endpoint, credentials or session tokens, and connection settings; the root cause class is CWE-532 (Insertion of Sensitive Information into Log File), meaning the provider emits part of that configuration into log output rather than redacting it. This matters because Terraform runs inside CI/CD pipelines where stdout, TF_LOG output, and terraform.log artifacts are commonly forwarded to central log aggregation platforms with broad read access. The confidentiality impact is intentionally limited (C:L) because disclosure depends on both the sensitivity of the fields written and the attacker's ability to reach the logs, and the CPE record cpe:2.3:a:dell:terraform_provider_for_ome:*:*:*:*:*:*:*:* confirms the Terraform provider, not the appliance firmware or OME itself, is the vulnerable artifact.
Know when Terraform Provider For Ome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Low-privileged authenticated actor (PR:L) with network reach to read logs; only limited confidentiality impact from leaked log data, no integrity or availability effect.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
1DescriptionCVE.org
Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Log File vulnerability in the provider configuration component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB