Dell SmartFabric OS10: incorrect authorization lets a low-privileged user execute commands

Impact

A low-privilege account on a Dell OS10 switch can run commands it should not be allowed to, with high impact on confidentiality, integrity and availability. Whoever controls a fabric switch can see, redirect or drop traffic for every node behind it, and in multi-tenant GPU clusters that traffic crosses tenants. Attack complexity is rated high, and the record does not describe the preconditions.

Who can reach it

Network access to the switch management interface plus a valid low-privilege account. Authentication is required.

What to do

Upgrade SmartFabric OS10 to 10.6.0.10 or later (Dell DSA-2026-438). Upgrading a switch OS image normally means reloading the switch, so plan the rollout around fabric redundancy. Until then, restrict management-plane access and cut low-privilege accounts down to the ones that are needed.

References

Related entries

• Dell SmartFabric OS10: improper access control lets a low-privileged user cause a denial of serviceCVE-2026-61417 · Dell SmartFabric OS10 (datacenter switch OS)Medium
• Linux kernel (drivers/net/ethernet/mellanox/mlx5/core): Two CPUs write to the internal control send queue withoutCVE-2026-64210 · Linux kernel (drivers/net/ethernet/mellanox/mlx5/core)High
• Linux kernel (drivers/infiniband/hw/mlx5): When on-demand-paging translation-table population fails, the UMR pathCVE-2026-74396 · Linux kernel (drivers/infiniband/hw/mlx5)High
• Dell OMSA: unauthenticated path traversal exposes arbitrary files from the managed nodeCVE-2026-81481 · Dell OpenManage Server Administrator (path traversal, unauthenticated)High
• FreeIPMI ipmi-oem: stack buffer over-read when a BMC returns a short Fujitsu SEL responseCVE-2026-85505 · FreeIPMI ipmi-oem (Fujitsu get-sel-entry-long-text handler)High
• HPE Networking Fabric Composer: unauthenticated SQL injection from an adjacent networkCVE-2026-95748 · HPE Networking Fabric Composer (database query handling)High