Dell Terraform Provider for Redfish: Improper certificate validation enables MITM
Summary
Dell Terraform Provider for Redfish versions prior to 1.6.2 disable TLS certificate verification in the base HTTP transport. An attacker positioned as a man-in-the-middle on the network path between the provider and the BMC can intercept Redfish traffic, including BMC credentials, and gain unauthorized access. The attacker needs no authentication but must already be able to intercept traffic on that path.
Affected
- Dell Terraform Provider for Redfish, versions prior to 1.6.2 (CVE-2026-91881)
Fixed in
- Dell Terraform Provider for Redfish: version 1.6.2 or later
- The fix is likely included in v1.6.2 (release note: "#357 - Respect the ssl_insecure setting when configuring TLS certificate verification"), but the release notes do not name this CVE.
Workaround
- Unknown. No workaround is documented in the CVE record or in Dell's advisory.
- Interim measure (not from the vendor): run the provider only on trusted management networks and avoid untrusted paths until upgraded.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV.
- EPSS 0.00231 (Vulners).
- No public proof of concept or exploitation report found.
Our recommendation
- Upgrade the Dell Terraform Provider for Redfish to version 1.6.2 or later. Also upgrade for CVE-2026-76113, which affects versions 1.1.0 through 1.6.1.
- Until the upgrade, run the provider only on isolated management VLANs and avoid routed or Wi-Fi paths to BMCs.
- Check the Dell advisory DSA-2026-434 for the authoritative fix version.
- Rotate BMC credentials if the provider has been used across untrusted paths.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell DSA-2026-434 advisory www.dell.com
- GitHub release v1.6.2 github.com
- VulDB 419973 vuldb.com
- OpenCVE CVE-2026-91881 app.opencve.io
- Vulners VulnCheck record CVE-2026-91881 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:08.
Original description (NVD)
Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access. This is a Critical severity vulnerability as it allows an unauthenticated attacker to intercept all Redfish BMC traffic including credentials by performing a man-in-the-middle attack, since TLS certificate verification is unconditionally disabled in the base HTTP transport. Dell recommends customers to upgrade at the earliest opportunity.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.