CVE-2026-91882: CWE-209: Generation of Error Message Containing Sensitive Information in Dell Terraform Provider for OME

CVE-2026-91882 is a vulnerability in Dell Terraform Provider for OME affecting versions 1.0.0 through 1.2.3. The issue arises from the API client error handling component, which improperly inserts sensitive information into error messages that are accessible externally. This exposure could be exploited remotely by an unauthenticated attacker, leading to disclosure of sensitive information. The vulnerability is categorized under CWE-209, which concerns the generation of error messages containing sensitive information.

An unauthenticated remote attacker could exploit this vulnerability to access sensitive information disclosed through error messages. The impact includes high confidentiality loss, limited integrity impact, and limited availability impact as indicated by the CVSS vector. This could facilitate further attacks or information gathering by adversaries.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Dell's advisories for updates. Until a fix is available, restrict access to the affected Terraform Provider for OME instances and avoid exposing error messages to untrusted networks where possible.