{"id":"CVE-2026-91878","kind":"vulnerability","aliases":["CVE-2026-91878"],"related":[],"title":"Dell OpenManage Ansible Modules: XML output injection by low-privileged remote attacker","description":"Dell OpenManage Ansible Modules, versions 6.0.0 through 10.0.3, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the XML data conversion component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to XML injection, malicious content injection, and XML parsing errors","summary":"Dell OpenManage Ansible Modules versions 6.0.0 through 10.0.3 do not neutralize special characters in XML data conversion output. An attacker with low privileges and remote access can inject XML content and cause XML parsing errors.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dellemc.openmanage","fixed":["11.0.0"],"affected":">= 6.0.0, <= 10.0.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["ansible","dell-openmanage","infrastructure","self-hosted","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"Run 'ansible-galaxy collection list dellemc.openmanage' (or 'pip/ansible-galaxy' equivalent for your install) and compare with 6.0.0 through 10.0.3; those are affected, 11.0.0 or later is remediated. Also check requirements.yml / collections lock files in your playbook repos for a pinned dellemc.openmanage version.","fix":"Upgrade Dell OpenManage Ansible Modules to version 11.0.0 or later (Dell DSA-2026-432). Dell lists no workaround for this CVE.","status":"open","published_at":"2026-11-11T19:17:47+00:00","first_seen_at":"2026-11-11T19:28:49+00:00","triaged_at":"2026-11-11T19:29:59+00:00","updated_at":"2026-11-11T19:31:03+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T19:29:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Dell OpenManage Ansible Modules: XML output injection by low-privileged remote attacker","impact":"low","summary":"Dell OpenManage Ansible Modules versions 6.0.0 through 10.0.3 do not neutralize special characters in XML data conversion output. An attacker with low privileges and remote access can inject XML content and cause XML parsing errors.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["dell-openmanage","ansible","infrastructure"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker injects XML content and breaks XML parsing","analyst_note":"Confirm the fixed version and advisory from Dell's security bulletin; the NVD entry gives only the affected range.","how_to_check":"- Check the installed OpenManage Ansible Modules version against the affected range 6.0.0 through 10.0.3 (unknown how to read it from the sources)\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Teams that run Dell OpenManage Ansible Modules in versions 6.0.0 through 10.0.3 to manage Dell servers and infrastructure. The flaw sits in the XML data conversion component and needs a low-privileged account with remote access. Teams on other versions or without these modules can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000729,"input_tokens":4596,"output_tokens":539,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and advisory from Dell's security bulletin; the NVD entry gives only the affected range.","search":"'-2026':15A,18A '-91878':16A,19A '10.0.3':37B,72C '6.0.0':35B,70C 'access':55B,101C 'ansibl':3A,21B,32B,67C 'attack':13A,49B,98C 'caus':61B 'charact':42B 'compon':86C,94C 'contain':73C 'content':59B,112C 'convers':46B,93C 'could':102C 'cve':14A,17A 'data':45B,92C 'dell':1A,23B,30B,65C 'dell-openmanag':22B 'dellemc.openmanage':20A 'downstream':85C 'element':79C 'error':64B,117C 'exploit':104C 'host':28B 'improp':75C 'infrastructur':25B 'inject':7A,57B,87C,110C,113C 'lead':107C 'low':10A,51B,96C 'low-privileg':9A 'malici':111C 'modul':4A,33B,68C 'neutral':40B,76C 'openmanag':2A,24B,31B,66C 'output':6A,47B,81C 'pars':63B,116C 'potenti':103C 'privileg':11A,52B,97C 'remot':12A,54B,100C 'self':27B 'self-host':26B 'special':41B,78C 'use':82C 'vendor':29B 'version':34B,69C 'vulner':88C,106C 'xml':5A,44B,58B,62B,91C,109C,115C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Dell OpenManage Ansible Modules 6.0.0 through 10.0.3 to automate Dell PowerEdge servers (iDRAC, OpenManage Enterprise). Per Dell, a low-privileged attacker with remote access could inject XML content and cause XML parsing errors in the XML data conversion component. Teams on 11.0.0 or later, or not using these modules, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T19:31:03Z","by":"analyst","doc":"https://github.com/dell/dellemc-openmanage-ansible-modules/releases","run_id":3581},"products":{"at":"2026-11-11T19:31:03Z","by":"analyst","doc":"https://github.com/dell/dellemc-openmanage-ansible-modules/releases","run_id":3581},"how_to_check":{"at":"2026-11-11T19:31:03Z","by":"analyst","doc":"https://github.com/dell/dellemc-openmanage-ansible-modules/releases","run_id":3581},"who_affected":{"at":"2026-11-11T19:31:03Z","by":"analyst","doc":"https://github.com/dell/dellemc-openmanage-ansible-modules/releases","run_id":3581}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["dellemcopenmanage"],"ptokens":["dellemc","openmanage"],"labels":["ansible","dellopenmanage","high","infrastructure","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':15A,18A '-91878':16A,19A 'ansibl':3A 'attack':13A 'cve':14A,17A 'dell':1A 'dellemc.openmanage':20A 'inject':7A 'low':10A 'low-privileg':9A 'modul':4A 'openmanag':2A 'output':6A 'privileg':11A 'remot':12A 'xml':5A","search_b":"'10.0.3':37B '6.0.0':35B 'access':55B 'ansibl':21B,32B 'attack':49B 'caus':61B 'charact':42B 'content':59B 'convers':46B 'data':45B 'dell':23B,30B 'dell-openmanag':22B 'error':64B 'host':28B 'infrastructur':25B 'inject':57B 'low':51B 'modul':33B 'neutral':40B 'openmanag':24B,31B 'output':47B 'pars':63B 'privileg':52B 'remot':54B 'self':27B 'self-host':26B 'special':41B 'vendor':29B 'version':34B 'xml':44B,58B,62B","search_c":"'10.0.3':72C '6.0.0':70C 'access':101C 'ansibl':67C 'attack':98C 'compon':86C,94C 'contain':73C 'content':112C 'convers':93C 'could':102C 'data':92C 'dell':65C 'downstream':85C 'element':79C 'error':117C 'exploit':104C 'improp':75C 'inject':87C,110C,113C 'lead':107C 'low':96C 'malici':111C 'modul':68C 'neutral':76C 'openmanag':66C 'output':81C 'pars':116C 'potenti':103C 'privileg':97C 'remot':100C 'special':78C 'use':82C 'version':69C 'vulner':88C,106C 'xml':91C,109C,115C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91878","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91878","severity":null,"published_at":"2026-11-11T19:17:47+00:00","modified_at":"2026-11-11T19:17:47+00:00","first_seen_at":"2026-11-11T19:28:49+00:00","fetched_at":"2026-11-11T19:28:49+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91878:3581","url":"https://www.dell.com/support/kbdoc/en-us/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities","severity":null,"published_at":"2026-11-11T19:31:03+00:00","modified_at":"2026-11-11T19:31:03+00:00","first_seen_at":"2026-11-11T19:31:03+00:00","fetched_at":"2026-11-11T19:31:03+00:00","note":"Dell DSA-2026-432 (2026-09-30) confirms affected 6.0.0-10.0.3, fixed in 11.0.0; no workaround listed for this CVE. No exploitation or PoC found; did not search social.","cites":["https://www.dell.com/support/kbdoc/en-us/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities","https://github.com/dell/dellemc-openmanage-ansible-modules/releases"]}],"documents":[{"id":128309,"url":"https://www.dell.com/support/kbdoc/en-us/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities","title":"DSA-2026-432: Security Update for Dell Ansible Server Vulnerabilities","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":128310,"url":"https://github.com/dell/dellemc-openmanage-ansible-modules/releases","title":"dellemc-openmanage-ansible-modules releases (v11.0.0)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}