Dell OpenManage Ansible Modules: XML injection in XML data conversion
Summary
Dell OpenManage Ansible Modules versions 6.0.0 through 10.0.3 contain an injection flaw in the XML data conversion component. An attacker with a low-privilege account and remote access can inject XML and malicious content, and trigger XML parsing errors. The issue affects integrity and availability rather than confidentiality, and it is not exploitable without a valid account.
Affected
- Dell OpenManage Ansible Modules 6.0.0 through 10.0.3 (per Dell CNA description)
- Lower bound per Dell description is 6.0.0; the CVE.org record states 0 (unverified)
Fixed in
- Fixed in version 11.0.0 or later (per CVE.org record; verify in the Dell advisory DSA-2026-432)
Workaround
Unknown.
Exploitation
- No evidence of in-the-wild exploitation found at time of research.
- VulDB states that neither technical details nor an exploit are publicly available.
- CISA KEV status not checked.
Our recommendation
- Identify whether Dell OpenManage Ansible Modules is in use and which versions are installed.
- Upgrade to version 11.0.0 or later in the next maintenance window; verify the release in the Dell advisory first.
- Restrict access to the Ansible automation host and its service accounts, as the attacker needs a low-privilege account.
- Monitor automation logs for unexpected XML content or parsing errors.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- DSA-2026-432 Dell security advisory www.dell.com
- CVE.org record CVE-2026-91878 www.cve.org
- VulDB CVE-2026-91878 vuldb.com
- Threatint mirror of CNA text cve.threatint.com
- OffSeq threat radar radar.offseq.com
- Ansible OpenManage collection documentation docs.ansible.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:32.
Original description (NVD)
Dell OpenManage Ansible Modules, versions 6.0.0 through 10.0.3, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the XML data conversion component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to XML injection, malicious content injection, and XML parsing errors
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.