Vulnerability record/PUBLISHED/Published Nov 11, 2026 18:01:43 UTC

CVE-2026-91880

Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0, contains an Improper Certificate Validation vulnerability in the SSH client component.Terraform PowerFlex provider uses ssh.InsecureIgnoreHostKey() as the default SSH host key callback. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.

Base score8.9/ 10

SeverityHighCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityHigh

Attack vectorNetworkAV

Attack complexityHighAC

Privileges requiredNonePR

User interactionNoneUI

ScopeChangedS

Confidentiality impactHighC

Integrity impactHighI

Availability impactLowA

CVSS vector stringCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authoritydell

Last updatedNov 11, 2026 18:01:43 UTC

PublishedNov 11, 2026 18:01:43 UTC

ReservedSep 15, 2026 10:04:43 UTC