Dell OpenManage Enterprise: path traversal exposes information to a low-privileged remote user

Impact

A pathname supplied to OpenManage Enterprise is not properly confined to its intended directory, letting a remote low-privileged account read data it should not. Dell states the impact as information exposure and does not name the files reachable, so treat the blast radius as unquantified rather than assuming the whole filesystem. The concern is the appliance's role: OME is the console that inventories and manages the iDRACs of every GPU server, and material recovered from it feeds directly into access on the out-of-band network. Confidentiality only per the scored vector.

Who can reach it

A remote attacker with a low-privileged OpenManage Enterprise account, reaching the OME console over the network. Authentication is required; no user interaction.

What to do

Update OpenManage Enterprise to 4.7.0 or later per Dell DSA-2026-359 — the same release that fixes CVE-2026-70423, so patch both together. The window is a restart of the OME appliance only; managed GPU servers are unaffected and need no drain, reboot or firmware flash. Keep the OME console restricted to the management VLAN and review low-privileged account holders.

References

Related entries

• Arista EOS: DHCP relay forwards replies from unconfigured servers, allowing client config spoofingCVE-2026-73437 · Arista EOS DHCP relay (helper-address source validation)Medium
• Dell OMSA: authenticated path traversal lets a low-privileged user read files off the nodeCVE-2026-81453 · Dell OpenManage Server Administrator (path traversal, authenticated)Medium
• RNIC on-board SRAM metadata cache (page table entries, QP context) - most widely deployed RDMA NIC: RNICs cacheNCVD-2019-003-rnic-on-board-sram-metadata-cach · RNIC on-board SRAM metadata cache (page table entries, QP context) - most widely deployed RDMA NICMedium
• RNIC on-board SRAM metadata cache (page table entries, QP context) - most widely deployed RDMA NIC: RNICs cacheNCVD-2019-006-rnic-on-board-sram-metadata-cach · RNIC on-board SRAM metadata cache (page table entries, QP context) - most widely deployed RDMA NICMedium
• RoCEv2 congestion control - DCQCN, ECN marking and Congestion Notification Packets: DCQCN reacts to ECN marks by havingNCVD-2022-003-rocev2-congestion-control-dcqcn · RoCEv2 congestion control - DCQCN, ECN marking and Congestion Notification PacketsMedium
• RNIC microarchitectural resources (NIC cache, processing units) under multi-tenant RDMA: This is the paper thatNCVD-2023-006-rnic-microarchitectural-resource · RNIC microarchitectural resources (NIC cache, processing units) under multi-tenant RDMAMedium