The Dell Terraform Provider for Redfish contains a flaw in the redfish_certificate resource that allows an unauthorized actor to read sensitive certificate data. A high‑privileged attacker with remote access to the Terraform runtime could exploit this weakness, leading to disclosure of confidential information. The vulnerability is a classic case of information disclosure and is identified as CWE‑532.

The affected component is the redfish_certificate resource in Dell Terraform Provider for Redfish, which has been observed in versions 1.1.0 through 1.6.1. This product is used by organizations that employ Terraform to manage Dell servers via the Redfish API.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of < 1% indicates a very low but nonzero exploitation probability and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a high‑privileged attacker who can reach the Terraform environment remotely. From the description, the attack vector is inferred to be remote access to the provider, with no mention of local escalation or physical compromise. The impact is limited to the exposure of sensitive certificate information, with no known privilege escalation or lateral movement potential. The low EPSS score suggests limited evidence of exploitation in the wild.