---
id: "CVE-2026-91875"
page: "https://infrastack.ai/live/CVE-2026-91875"
kind: "vulnerability"
aliases: ["CVE-2026-91875"]
title: "Dell OpenManage Ansible Modules: certificate checks flaw exposes sessions to attackers"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Dell OpenManage Ansible Modules", "fixed": ["11.0.0"], "affected": ">= 9.2.0, <= 10.0.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ansible", "dell-openmanage", "idrac", "infrastructure", "self-hosted"]
not_affected_if: ["outside-affected-versions", "validate-certs-enabled"]
published_at: "2026-11-11T19:17:47+00:00"
first_seen_at: "2026-11-11T19:28:48+00:00"
updated_at: "2026-11-11T19:31:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91875", "first_seen_at": "2026-11-11T19:28:48+00:00"}, {"source": "analyst", "url": "https://www.dell.com/support/kbdoc/en-us/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities", "first_seen_at": "2026-11-11T19:31:04+00:00", "cites": ["https://www.dell.com/support/kbdoc/en-us/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities", "https://github.com/dell/dellemc-openmanage-ansible-modules/releases"]}]
exploit_sources: []
---

# Dell OpenManage Ansible Modules: certificate checks flaw exposes sessions to attackers

Link for people: https://infrastack.ai/live/CVE-2026-91875 (this .md is for agents)

Dell OpenManage Ansible Modules versions 9.2.0 through 10.0.3 do not properly validate certificates in the SessionAPI component. An unauthenticated remote attacker could potentially read information and gain unauthorized access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Dell OpenManage Ansible Modules affected >= 9.2.0, <= 10.0.3 fixed 11.0.0

## How to check

Run 'ansible-galaxy collection list dellemc.openmanage' (or check requirements.yml / the collections path) and compare the version with the affected range 9.2.0 through 10.0.3. If it is in range, search your playbooks and roles for modules or code that use SessionAPI and check whether validate_certs is set to True.

## Fix

Upgrade the Dell OpenManage Ansible Modules collection to 11.0.0 or later (Dell DSA-2026-432). Until then, set validate_certs=True explicitly wherever SessionAPI is used.

## Timeline

- 2026-11-11T19:28:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91875
- 2026-11-11T19:31:04+00:00 analyst https://www.dell.com/support/kbdoc/en-us/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities — Dell DSA-2026-432 (2026-09-30): affected 9.2.0-10.0.3, fixed 11.0.0; workaround validate_certs=True for SessionAPI. No exploitation/PoC stated by Dell; no social search done (B tier).

## Documents

- [advisory] DSA-2026-432: Security Update for Dell Ansible Server Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities
- [fix] dellemc-openmanage-ansible-modules releases (v11.0.0) https://github.com/dell/dellemc-openmanage-ansible-modules/releases

## From the sources

Dell OpenManage Ansible Modules, versions 9.2.0 through 10.0.3, contains an Improper Certificate Validation vulnerability in the SessionAPI component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_