Dell OMSA: improper certificate validation allows adjacent-network interception of management traffic

CVSS 6.8CVE-2026-81447Firmware, BMC & network fabriccurated

Impact

OMSA does not validate certificates properly, so an attacker on the same network segment can sit in the middle of its management traffic, read it and alter it. On a management VLAN that carries hardware administration for a GPU fleet, that means credentials and management commands are exposed to anyone who has already gained a foothold on that segment - the flat, trusted management network many operators run is exactly the environment this bug assumes.

Who can reach it

Adjacent network position (same segment as the OMSA host or its peer). No authentication required.

What to do

Upgrade OMSA to 11.1.0.3 or later on all managed nodes and restart the OMSA services. Until then, treat the management VLAN as the only control and keep it segmented from tenant and general corporate networks.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-81447 https://www.dell.com/support/kbdoc/en-us/000506586/dsa-2026-403-security-update-for-dell-openmanage-server-administrator-omsa-network-access-vulnerabilitiesv

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.