CVE-2026-91882 Dell CVE debrief

Who should care

Defenders responsible for remote access configurations, API client security, and sensitive information protection should assess exposure and potential impact. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Why it matters

CVE-2026-91882 is a HIGH-severity vulnerability in Dell Terraform Provider for OME that could lead to information exposure. Defenders should prioritize verifying exposure, assessing potential impact, and updating to version 1.2.4 or later if affected.

• Information exposure through API client error handling
• Potential unauthorized access to sensitive information
• Need for verification of affected versions and configurations
• Priority on updating to version 1.2.4 or later

Technical summary

The Dell Terraform Provider for OME contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in the API client error handling component. This vulnerability has a CVSS score of 8.6 and is classified as HIGH severity. The vulnerability could lead to information exposure, and defenders should prioritize verifying exposure and assessing potential impact, focusing on remote access points and API client configurations. Affected product deployments should be verified, and official advisories should be reviewed to validate affected scope, severity, and vendor guidance.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on remote access points and API client configurations.

Recommended defensive actions

• Verify exposure by checking API client configurations and remote access points
• Assess potential impact on sensitive information
• Update to version 1.2.4 or later if affected
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and potential exploitation. However, additional information on exploitation, impact, and remediation is limited. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations. Compensating controls and monitoring should be reviewed for exposed systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.