Dell OpenManage Ansible Modules: XML External Entity reference (XXE)
Summary
Dell OpenManage Ansible Modules, used to automate configuration and updates of Dell PowerEdge servers, contains an XML External Entity (XXE) flaw in its XML parsing component. A low-privileged local user can exploit it to read sensitive information, with no effect on integrity or availability. The attacker needs local access and an existing low-privileged account on the affected host.
Affected
- Dell OpenManage Ansible Modules 2.0.4 through 10.0.3, according to the CVE description.
- The CNA product-status field instead lists versions from 0 before 11.0.0, so the lower bound is unconfirmed until checked against Dell advisory DSA-2026-432.
Fixed in
- Upgrade to version 11.0.0 or later (per third-party aggregator data; verify against DSA-2026-432).
- No fixed version for other release branches was found.
Workaround
Unknown. No vendor workaround was found; the sources only cite the upgrade.
Exploitation
- No known exploitation in the wild; not listed in CISA KEV.
- No public proof of concept found. VulDB rates exploitation as easy, which is its own assessment.
- NVD analysis was still pending at the time of research.
Our recommendation
- Inventory all hosts running OpenManage Ansible Modules.
- Plan the upgrade to version 11.0.0 or later, and prioritise the higher-rated CVE-2026-91873 to CVE-2026-91878 in the same window.
- Restrict local logon and administrative access to these hosts until the upgrade is done.
- Verify the affected range and fixed version against DSA-2026-432.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- DSA-2026-432: Security Update for Dell Ansible Server Vulnerabilities www.dell.com
- CVE Record CVE-2026-91876 www.cve.org
- VulDB CVE-2026-91876 vuldb.com
- OffSeq Radar: CVE-2026-91876 radar.offseq.com
- Strix: CVE-2026-91876 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:44.
Original description (NVD)
Dell OpenManage Ansible Modules, versions 2.0.4 through 10.0.3, contains an Improper Restriction of XML External Entity Reference vulnerability in the XML parsing component. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.