CVE-2026-91881 Dell CVE debrief

Who should care

Defenders responsible for Dell Terraform Provider for Redfish deployments should assess exposure and prioritize upgrading to version 1.6.2 or later. They should also implement proper certificate validation, monitor traffic for potential attacks, and review compensating controls for exposed systems.

Why it matters

CVE-2026-91881 allows unauthenticated attackers to intercept Redfish BMC traffic. Defenders should upgrade to version 1.6.2 or later, implement proper certificate validation, and monitor traffic for potential attacks.

• Intercepting Redfish BMC traffic, including credentials, via man-in-the-middle attacks
• Information exposure and unauthorized access to Redfish BMC systems
• Potential for lateral movement within compromised networks
• Verification of proper certificate validation implementation in Redfish deployments

Technical summary

Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access. This vulnerability is a result of unconditionally disabled TLS certificate verification in the base HTTP transport, allowing for man-in-the-middle attacks. Dell recommends customers to upgrade at the earliest opportunity.

Defensive priority

Upgrade to version 1.6.2 or later at the earliest opportunity.

Recommended defensive actions

• Upgrade Dell Terraform Provider for Redfish to version 1.6.2 or later
• Implement proper certificate validation for Redfish BMC traffic
• Monitor Redfish traffic for potential man-in-the-middle attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and Dell's advisory confirm the vulnerability in Dell Terraform Provider for Redfish versions prior to 1.6.2. The vulnerability allows unauthenticated attackers with remote access to potentially exploit this vulnerability, leading to information exposure and unauthorized access. Evidence is limited to public CVE and vendor sources; defenders should verify affected scope and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.