Dell OpenManage Enterprise: low-privileged user can inject script into the console and expose information

Impact

OpenManage Enterprise is the console that drives iDRAC across a server fleet: it stores BMC credentials, pushes firmware and BIOS payloads and can power-cycle hosts. A low-privileged console account can inject script that executes in another console user's browser, which Dell describes as leading to information exposure - in practice, whatever the victim's session can see in the console. Dell scores it 4.6 and does not claim command execution or configuration change through this issue, so treat it as an exposure of management-console data rather than a takeover of the out-of-band path. It ships in the same DSA-2026-359 update as the higher-severity OpenManage fixes, so the maintenance window is shared.

Who can reach it

Remote network access to the OpenManage Enterprise web interface with a low-privileged console account, plus a victim console user who interacts with the injected content (UI:R). Not reachable without an account on the appliance.

What to do

Upgrade the appliance to OpenManage Enterprise 4.7.0 or later per DSA-2026-359 - an appliance update and restart, with no host or GPU node outage. Keep the console off tenant-reachable networks and restricted to the management VLAN, and review which accounts hold low-privileged console access, since that is the precondition here.

References