DELLEMC.OPENMANAGE · CVE-2026-91878 · Vendor
FIX → 11.0.0 ✓ verified
Dell OpenManage Ansible Modules versions 6.0.0 through 10.0.3 do not neutralize special characters in XML data conversion output. An attacker with low privileges and remote access can inject XML content and cause XML parsing errors.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run Dell OpenManage Ansible Modules 6.0.0 through 10.0.3 to automate Dell PowerEdge servers (iDRAC, OpenManage Enterprise). Per Dell, a low-privileged attacker with remote access could inject XML content and cause XML parsing errors in the XML data conversion component. Teams on 11.0.0 or later, or not using these modules, can skip it.
Not affected if unaffected-version
Who cares ansible, dell-openmanage, infrastructure, self-hosted
ansible-galaxy collection list dellemc.openmanage (or pip/ansible-galaxy equivalent for your install) and compare with 6.0.0 through 10.0.3; those are affected, 11.0.0 or later is remediatedDell OpenManage Ansible Modules, versions 6.0.0 through 10.0.3, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the XML data conversion component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to XML injection, malicious content injection, and XML parsing errors
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 11.0.0
11.0.0 or later (Dell DSA-2026-432)