Dell Ansible Storage for Unity: Improper certificate validation
Summary
Dell Ansible Storage for Unity, an Ansible collection for managing Dell Unity storage systems, does not properly validate certificates in the UnityRESTConnector component in versions prior to 1.2.13. A remote attacker who can intercept or redirect the connection between the automation host and the Unity management system could potentially obtain sensitive information and gain unauthorized access. No authentication is required, but the attack is complex and needs a suitable network position.
Affected
- Dell Ansible Storage for Unity, versions prior to 1.2.13 (the vendor's product table lists prior to 1.2.12)
Fixed in
- Version 1.2.13 or later (per Dell DSA-2026-431)
Workaround
- Explicitly enable certificate verification by setting verify=True in playbooks (per Dell advisory)
- Do not disable certificate validation
- Run Unity automation only from trusted management networks until patched
Exploitation
- No evidence of exploitation in the wild found at the time of research (OffSeq: not known to be exploited)
- No public proof-of-concept found; status unknown
- Published 11 Nov 2026, so public research is limited
Our recommendation
- Inventory hosts that run the dellemc.unity collection and record their versions
- Upgrade to version 1.2.13 or later
- Check playbooks and configurations for disabled or missing certificate validation and set verify=True
- Restrict access from automation hosts to the Unity management interface to trusted networks
- Re-check CISA KEV and public exploit sources over the coming weeks
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell DSA-2026-431 Security Update www.dell.com
- OffSeq: CVE-2026-91890 entry radar.offseq.com
- CVE record mirror: CVE-2026-91890 cve.threatint.com
- Dell Community: Unity Ansible module and CA certificates www.dell.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:23.
Original description (NVD)
Dell Ansible Storage for Unity , versions prior to 1.2.13 contains an Improper Certificate Validation vulnerability in the UnityRESTConnector component. An unauthenticated attacker with remote access could potentially exploit this vulnerability,leading to information exposure and unauthorized access.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.