CVE-2026-76113: CWE-532: Insertion of Sensitive Information into Log File in Dell Terraform Provider for Redfish

CVE-2026-76113 is a vulnerability in Dell Terraform Provider for Redfish affecting versions 1.1.0 through 1.6.1. The flaw exists in the redfish_certificate resource component, where sensitive information is improperly inserted into log files, potentially exposing it to unauthorized actors. Exploitation requires a high privileged attacker with remote access. The vulnerability is categorized as CWE-532 (Exposure of Sensitive Information through Log Files). The CVSS v3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, high privileges required, and user interaction needed.

An attacker with high privileges and remote access could exploit this vulnerability to gain access to sensitive information that is logged improperly by the redfish_certificate resource. This exposure could lead to unauthorized disclosure of sensitive data, potentially impacting confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a patch is released, limit remote access to highly privileged users and monitor for any suspicious activity related to the redfish_certificate resource. Avoid exposing sensitive information in logs where possible.