CVE-2026-91891
Dell Terraform Provider for PowerStore, versions prior to 1.3.1 , contains a vulnerability that may cause sensitive authentication data to
CVSS
7.5
High
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 11, 2026 · Last modified: Nov 11, 2026 · CWE-532
Not enough EPSS history yet.
Dell Terraform Provider for PowerStore, versions prior to 1.3.1 , contains a vulnerability that may cause sensitive authentication data to be insufficiently redacted in diagnostic logs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-918798.8 HIG—
———Dell Terraform for ObjectScale and Powerstore, versions prior to 1.1.1 (ObjectScale) and versions 1.2.1 through 1.3.0 (PowerStore) contains an insertion of sensitive information into Log File vulnerability in the client initialization component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.8hCVE-2026-918725.5 MED—
———Dell Ansible Storage for PowerStore, versions prior to 3.9.0,contains an Insertion of Sensitive Information into Log File vulnerability in the configuration module. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.8hCVE-2026-1209766.0 MED3.1%
——1On affected platforms running Arista EOS with IEEE 802.1X authentication and MACsec using dynamically derived keys, sensitive authentication information may be recorded in diagnostic data during a Smart Switch Upgrade (SSU).
An attacker with administrative access on the device who obtains the affected diagnostic data could recover sensitive authentication information. This could potentially compromise the confidentiality and integrity of traffic protected by MACsec on the affected link.
The vulnerability is only exposed during and after an SSU reload where an active 802.1X session used for MACsec is present.1dCVE-2026-1207927.3 HIG36.7%
——11Insertion of sensitive information into log file in Aspire allows an authorized attacker to disclose information locally.14hCVE-2026-123082—1.4%
——0Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token (a JWT) in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker Desktop component logged the token when it requested it from the backend. An attacker with read access to these files could obtain the token and use it to read and modify the user's Docker Hub data as that user while the token remains valid. Docker Desktop 4.94.0 redacts these payloads. The fix does not rewrite logs written by earlier versions, which can still contain tokens after upgrading.1dCVE-2026-102289—15.8%
——5zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, --gh-token, --github-token, or --zizmor-github-token to be written to stderr in cleartext. A single -v or --verbose option or an applicable RUST_LOG directive enables the affected logging during normal online operation and --no-online-audits, while explicit --offline clears the token first. If another party can read a CI log, support artifact, terminal capture, or public bug report containing the output, the party can use the credential according to its scopes, repository access, and lifetime. This vulnerability is fixed in 1.28.0.2d