Dell iDRAC9 / iDRAC10 (memory erase, data remanence): Data survives an iDRAC memory erase and stays readable

CVSS 3.5CVE-2026-70412Firmware, BMC & network fabricDSA-2026-348curated

Impact

Data survives an iDRAC memory erase and stays readable afterwards. The CVSS is low, but the operational meaning for a bare-metal GPU cloud is not: the erase step in your node-reprovisioning pipeline does not actually erase, so a low-privilege user on the next tenancy can read remnants left by the previous one. This is exactly the cross-tenant handoff failure that bare-metal operators promise does not happen, and it fails quietly - the wipe reports success. Affects both the iDRAC9 and iDRAC10 generations.

Who can reach it

A low-privilege account with remote access to the iDRAC - which on a bare-metal cloud can be the next tenant, if your product hands tenants any BMC-adjacent access at all, or anyone reaching the management VLAN.

What to do

Flash iDRAC9 to 7.20.30.50 or iDRAC10 to 1.20.60.50 or later. Out-of-band, per-node, no host reboot and no job drain. Beyond the flash, treat this as a pipeline bug rather than a node bug: if your reprovisioning runbook relies on the iDRAC erase as the cross-tenant boundary, add an independent verification step, and consider re-checking nodes that were recycled between tenants on unpatched firmware.

References

https://www.dell.com/support/kbdoc/en-us/000497902/dsa-2026-348-security-update-for-dell-idrac9-and-idrac10-vulnerability https://nvd.nist.gov/vuln/detail/CVE-2026-70412

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.