---
id: "CVE-2026-91878"
page: "https://infrastack.ai/live/CVE-2026-91878"
kind: "vulnerability"
aliases: ["CVE-2026-91878"]
title: "Dell OpenManage Ansible Modules: XML output injection by low-privileged remote attacker"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "dellemc.openmanage", "fixed": ["11.0.0"], "affected": ">= 6.0.0, <= 10.0.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ansible", "dell-openmanage", "infrastructure", "self-hosted", "vendor"]
not_affected_if: ["unaffected-version"]
published_at: "2026-11-11T19:17:47+00:00"
first_seen_at: "2026-11-11T19:28:49+00:00"
updated_at: "2026-11-11T19:31:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91878", "first_seen_at": "2026-11-11T19:28:49+00:00"}, {"source": "analyst", "url": "https://www.dell.com/support/kbdoc/en-us/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities", "first_seen_at": "2026-11-11T19:31:03+00:00", "cites": ["https://www.dell.com/support/kbdoc/en-us/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities", "https://github.com/dell/dellemc-openmanage-ansible-modules/releases"]}]
exploit_sources: []
---

# Dell OpenManage Ansible Modules: XML output injection by low-privileged remote attacker

Link for people: https://infrastack.ai/live/CVE-2026-91878 (this .md is for agents)

Dell OpenManage Ansible Modules versions 6.0.0 through 10.0.3 do not neutralize special characters in XML data conversion output. An attacker with low privileges and remote access can inject XML content and cause XML parsing errors.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:dellemc.openmanage affected >= 6.0.0, <= 10.0.3 fixed 11.0.0

## How to check

Run 'ansible-galaxy collection list dellemc.openmanage' (or 'pip/ansible-galaxy' equivalent for your install) and compare with 6.0.0 through 10.0.3; those are affected, 11.0.0 or later is remediated. Also check requirements.yml / collections lock files in your playbook repos for a pinned dellemc.openmanage version.

## Fix

Upgrade Dell OpenManage Ansible Modules to version 11.0.0 or later (Dell DSA-2026-432). Dell lists no workaround for this CVE.

## Timeline

- 2026-11-11T19:28:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91878
- 2026-11-11T19:31:03+00:00 analyst https://www.dell.com/support/kbdoc/en-us/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities — Dell DSA-2026-432 (2026-09-30) confirms affected 6.0.0-10.0.3, fixed in 11.0.0; no workaround listed for this CVE. No exploitation or PoC found; did not search social.

## Documents

- [advisory] DSA-2026-432: Security Update for Dell Ansible Server Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities
- [fix] dellemc-openmanage-ansible-modules releases (v11.0.0) https://github.com/dell/dellemc-openmanage-ansible-modules/releases

## From the sources

Dell OpenManage Ansible Modules, versions 6.0.0 through 10.0.3, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the XML data conversion component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to XML injection, malicious content injection, and XML parsing errors

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_