{"id":"CVE-2026-91875","kind":"vulnerability","aliases":["CVE-2026-91875"],"related":[],"title":"Dell OpenManage Ansible Modules: certificate checks flaw exposes sessions to attackers","description":"Dell OpenManage Ansible Modules, versions 9.2.0 through 10.0.3, contains an Improper Certificate Validation vulnerability in the SessionAPI component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.","summary":"Dell OpenManage Ansible Modules versions 9.2.0 through 10.0.3 do not properly validate certificates in the SessionAPI component. An unauthenticated remote attacker could potentially read information and gain unauthorized access.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Dell OpenManage Ansible Modules","fixed":["11.0.0"],"affected":">= 9.2.0, <= 10.0.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["ansible","dell-openmanage","idrac","infrastructure","self-hosted"],"not_affected_if":["outside-affected-versions","validate-certs-enabled"],"how_to_check":"Run 'ansible-galaxy collection list dellemc.openmanage' (or check requirements.yml / the collections path) and compare the version with the affected range 9.2.0 through 10.0.3. If it is in range, search your playbooks and roles for modules or code that use SessionAPI and check whether validate_certs is set to True.","fix":"Upgrade the Dell OpenManage Ansible Modules collection to 11.0.0 or later (Dell DSA-2026-432). Until then, set validate_certs=True explicitly wherever SessionAPI is used.","status":"open","published_at":"2026-11-11T19:17:47+00:00","first_seen_at":"2026-11-11T19:28:48+00:00","triaged_at":"2026-11-11T19:29:46+00:00","updated_at":"2026-11-11T19:31:04+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-11T19:29:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Dell OpenManage Ansible Modules: certificate checks flaw exposes sessions to attackers","impact":"high","summary":"Dell OpenManage Ansible Modules versions 9.2.0 through 10.0.3 do not properly validate certificates in the SessionAPI component. An unauthenticated remote attacker could potentially read information and gain unauthorized access.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["dell-openmanage","ansible"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker reads session information and gains unauthorized access","analyst_note":"Check Dell's security advisory for the fixed version and the exact exposure conditions; the NVD entry alone gives no fix.","how_to_check":"- Check the installed Dell OpenManage Ansible Modules version against the affected range `9.2.0` through `10.0.3`\n- unknown for other checks, as the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["outside-affected-versions"],"who_is_affected":"Teams that run Ansible playbooks with the Dell OpenManage Ansible Modules collection in versions 9.2.0 through 10.0.3 are exposed through the SessionAPI component. The sources do not say which configurations are required, so treat any use of the affected range as in scope.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000723,"input_tokens":4566,"output_tokens":532,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Dell's security advisory for the fixed version and the exact exposure conditions; the NVD entry alone gives no fix.","search":"'-2026':13A,16A '-91875':14A,17A '10.0.3':38B,67C '9.2.0':36B,65C 'access':59B,83C,95C 'ansibl':3A,22B,33B,62C 'ansible':20A 'attack':11A,51B,80C 'certif':5A,43B,71C 'check':6A 'compon':47B,77C 'contain':68C 'could':52B,84C 'cve':12A,15A 'dell':1A,18A,24B,31B,60C 'dell-openmanag':23B 'exploit':86C 'expos':8A 'exposur':92C 'flaw':7A 'gain':57B 'host':30B 'idrac':26B 'improp':70C 'inform':55B,91C 'infrastructur':27B 'lead':89C 'modul':4A,34B,63C 'modules':21A 'openmanag':2A,25B,32B,61C 'openmanage':19A 'potenti':53B,85C 'proper':41B 'read':54B 'remot':50B,82C 'self':29B 'self-host':28B 'session':9A 'sessionapi':46B,76C 'unauthent':49B,79C 'unauthor':58B,94C 'valid':42B,72C 'version':35B,64C 'vulner':73C,88C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Ansible with the Dell OpenManage Ansible Modules collection in versions 9.2.0 through 10.0.3 are affected through the SessionAPI component, which does not properly validate certificates. Dell's workaround is to set validate_certs=True explicitly when using SessionAPI, so playbooks that do this are the ones to check first. Teams that do not use this collection, or already run 11.0.0 or later, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T19:31:04Z","by":"analyst","doc":"https://github.com/dell/dellemc-openmanage-ansible-modules/releases","run_id":3582},"products":{"at":"2026-11-11T19:31:04Z","by":"analyst","doc":"https://github.com/dell/dellemc-openmanage-ansible-modules/releases","run_id":3582},"workarounds":{"at":"2026-11-11T19:31:04Z","by":"analyst","doc":"https://github.com/dell/dellemc-openmanage-ansible-modules/releases","run_id":3582},"how_to_check":{"at":"2026-11-11T19:31:04Z","by":"analyst","doc":"https://github.com/dell/dellemc-openmanage-ansible-modules/releases","run_id":3582}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["dellopenmanageansiblemodules","openmanageansiblemodules"],"ptokens":["ansible","dell","modules","openmanage"],"labels":["ansible","dellopenmanage","high","idrac","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-91875':14A,17A 'ansibl':3A 'ansible':20A 'attack':11A 'certif':5A 'check':6A 'cve':12A,15A 'dell':1A,18A 'expos':8A 'flaw':7A 'modul':4A 'modules':21A 'openmanag':2A 'openmanage':19A 'session':9A","search_b":"'10.0.3':38B '9.2.0':36B 'access':59B 'ansibl':22B,33B 'attack':51B 'certif':43B 'compon':47B 'could':52B 'dell':24B,31B 'dell-openmanag':23B 'gain':57B 'host':30B 'idrac':26B 'inform':55B 'infrastructur':27B 'modul':34B 'openmanag':25B,32B 'potenti':53B 'proper':41B 'read':54B 'remot':50B 'self':29B 'self-host':28B 'sessionapi':46B 'unauthent':49B 'unauthor':58B 'valid':42B 'version':35B","search_c":"'10.0.3':67C '9.2.0':65C 'access':83C,95C 'ansibl':62C 'attack':80C 'certif':71C 'compon':77C 'contain':68C 'could':84C 'dell':60C 'exploit':86C 'exposur':92C 'improp':70C 'inform':91C 'lead':89C 'modul':63C 'openmanag':61C 'potenti':85C 'remot':82C 'sessionapi':76C 'unauthent':79C 'unauthor':94C 'valid':72C 'version':64C 'vulner':73C,88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91875","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91875","severity":null,"published_at":"2026-11-11T19:17:47+00:00","modified_at":"2026-11-11T19:17:47+00:00","first_seen_at":"2026-11-11T19:28:48+00:00","fetched_at":"2026-11-11T19:28:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91875:3582","url":"https://www.dell.com/support/kbdoc/en-us/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities","severity":null,"published_at":"2026-11-11T19:31:04+00:00","modified_at":"2026-11-11T19:31:04+00:00","first_seen_at":"2026-11-11T19:31:04+00:00","fetched_at":"2026-11-11T19:31:04+00:00","note":"Dell DSA-2026-432 (2026-09-30): affected 9.2.0-10.0.3, fixed 11.0.0; workaround validate_certs=True for SessionAPI. No exploitation/PoC stated by Dell; no social search done (B tier).","cites":["https://www.dell.com/support/kbdoc/en-us/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities","https://github.com/dell/dellemc-openmanage-ansible-modules/releases"]}],"documents":[{"id":128309,"url":"https://www.dell.com/support/kbdoc/en-us/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities","title":"DSA-2026-432: Security Update for Dell Ansible Server Vulnerabilities","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":128310,"url":"https://github.com/dell/dellemc-openmanage-ansible-modules/releases","title":"dellemc-openmanage-ansible-modules releases (v11.0.0)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}