Dell OpenManage Ansible Modules: Injection in OData filter processing
Summary
Dell OpenManage Ansible Modules contains an improper neutralization of special elements in the OData filter processing component, which is used to build data queries. An attacker with remote access and a low-privileged account can exploit this without user interaction. Successful exploitation can lead to unauthorized data access, authorization bypass and denial of service.
Affected
- Dell OpenManage Ansible Modules, versions 2.0.2 through 10.0.3 (per CVE description)
- The official CVE record lists the range as 0 to before 11.0.0; to be confirmed in the Dell advisory
Fixed in
- Fixed in version 11.0.0 or later (according to third-party sources; confirm with Dell advisory DSA-2026-432)
Workaround
- Unknown: no CVE-specific workaround found. Upgrading is the only documented remedy.
- Interim: restrict network access to the Ansible control host and iDRAC/OME endpoints, and review low-privilege automation accounts
Exploitation
- No known exploitation at the time of writing.
- No public exploit code indexed; CISA KEV status not verified.
Our recommendation
- Identify all systems running Dell OpenManage Ansible Modules and their versions.
- Upgrade to version 11.0.0 or later after confirming the fixed version in DSA-2026-432.
- Restrict network access to the management network and review automation accounts for least privilege.
- Monitor for unusual OData queries from automation hosts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell DSA-2026-432 Security Update for Dell Ansible Server Vulnerabilities www.dell.com
- CVE Record CVE-2026-91877 www.cve.org
- OffSeq Radar: CVE-2026-91877 radar.offseq.com
- ThreatInt: CVE-2026-91877 cve.threatint.com
- Ansible Collection dellemc.openmanage documentation docs.ansible.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:31.
Original description (NVD)
Dell OpenManage Ansible Modules, versions 2.0.2 through 10.0.3, contains an Improper Neutralization of Special Elements in Data Query Logic vulnerability in the OData filter processing component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized data access, authorization bypass, and denial of service.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.