CVE-2026-91881

Awaiting Analysis Awaiting Analysis - Queue

Improper Certificate Validation in Dell Terraform Provider for Redfish

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Dell

Description

Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access. This is a Critical severity vulnerability as it allows an unauthenticated attacker to intercept all Redfish BMC traffic including credentials by performing a man-in-the-middle attack, since TLS certificate verification is unconditionally disabled in the base HTTP transport. Dell recommends customers to upgrade at the earliest opportunity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-91881

EUVD

EUVD-2026-101152

Affected Vendors & Products

Vendor	Product	Version / Range
Dell	Terraform	Provider for Redfish 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

Dell Terraform Provider for Redfish before version 1.6.2 has an Improper Certificate Validation flaw in its HTTP transport. This means the software does not verify TLS certificates properly, allowing attackers to intercept and read all Redfish BMC traffic, including credentials, via man-in-the-middle attacks.

Detection Guidance

This vulnerability involves improper certificate validation in Dell Terraform Provider for Redfish versions prior to 1.6.2. Detection requires checking the installed version of the provider and monitoring network traffic for unencrypted or improperly validated Redfish BMC communications.

Impact Analysis

An unauthenticated remote attacker could exploit this to steal sensitive data like login credentials or manipulate BMC traffic. This could lead to unauthorized system access, data breaches, or further network compromise.

Compliance Impact

This vulnerability could result in unauthorized access to personal or health data, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may lead to legal penalties and reputational damage.

Mitigation Strategies

Upgrade Dell Terraform Provider for Redfish to version 1.6.2 or later to address the improper certificate validation vulnerability.

Hi! I’m here to help you understand CVE-2026-91881. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70