Dell OpenManage Ansible Modules: Improper certificate validation in iDRAC Redfish API
Summary
Dell OpenManage Ansible Modules versions 2.1.2 through 10.0.3 do not properly validate certificates in the iDRACRedfishAPI component. An attacker with remote access who is positioned on the network path between the Ansible control node and iDRAC could impersonate the iDRAC endpoint, which may lead to information exposure and unauthorized access. The CNA rates the issue CVSS 8.7 (High), but the attack complexity is high and a network position is required.
Affected
- Dell OpenManage Ansible Modules 2.1.2 through 10.0.3 (CVE record, CNA Dell)- The CNA lists all versions before 11.0.0 as affected
Fixed in
- Upgrade to version 11.0.0 or later (per third-party aggregator; not yet verified against the Dell advisory DSA-2026-432)- Unknown whether a fix is available for 10.x versions
Workaround
- No vendor-specified workaround found- Interim measure (not vendor-stated): verify that validate_certs is not set to false in playbooks; Dell documents that validate_certs defaulted to False before collection version 5.0.0
Exploitation
- No known exploitation at the time of writing- No public proof of concept found- VulDB describes the issue as difficult to exploit and states that no authentication is required
Our recommendation
- Upgrade OpenManage Ansible Modules to version 11.0.0 or later after confirming the fixed version in Dell advisory DSA-2026-432- Check all playbooks for validate_certs: false and enable certificate validation with the iDRAC CA trusted- Restrict access from the Ansible control node to the iDRAC management network and keep user networks away from it- Monitor for proof-of-concept or exploitation reports; priority medium, high if the control node is shared or reachable from user networks
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell DSA-2026-432 Security Update for Dell Ansible Server Vulnerabilities www.dell.com
- CVE Record CVE-2026-91873 www.cve.org
- VulDB entry CVE-2026-91873 vuldb.com
- OffSeq Radar CVE-2026-91873 radar.offseq.com
- Dell OpenManage Ansible Modules reference guide dl.dell.com
- Dell OpenManage Ansible Modules 8.0.0 user guide: gather facts from iDRAC www.dell.com
- OpenManage Ansible Modules changelog github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:23.
Original description (NVD)
Dell OpenManage Ansible Modules, versions 2.1.2 through 10.0.3, contains an Improper Certificate Validation vulnerability in the iDRACRedfishAPI component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.