Dell OMSA: missing authentication on a critical function lets an unauthenticated attacker execute code

Impact

OMSA runs as a privileged agent on every Dell server it is installed on, and its web/agent service listens on the network. Dell states that an unauthenticated remote attacker can reach a critical function that is missing an authentication check and obtain remote execution. On a GPU fleet that means anyone who can reach the OMSA port on a management or host interface takes control of the node's hardware management agent, which runs with high privilege on the host that also owns the GPUs. Dell's advisory does not publish exploit detail or an attack-complexity narrative beyond the CVSS vector (AC:H).

Who can reach it

Network access to the OMSA service on a managed node. No authentication required.

What to do

Upgrade Dell OpenManage Server Administrator to 11.1.0.3 or later on every managed node (Windows, RHEL 8.10/9.4, SLES 15, Ubuntu 22.04 packages are all affected) and restart the OMSA services. Until then, restrict OMSA's listening port to the management network only, or remove OMSA from nodes that do not need it. Dell's DSA-2026-403 does not describe a configuration-only mitigation.

References

Related entries

• Dell OMSA: unauthenticated OS command injection gives remote execution on the managed nodeCVE-2026-81476 · Dell OpenManage Server Administrator (managed node service, OS command handling)High
• Dell OMSA: hard-coded cryptographic key allows unauthenticated access to the management agentCVE-2026-81478 · Dell OpenManage Server Administrator (hard-coded cryptographic key)High
• InfiniBand / RoCE memory protection - memory region rkey/lkey namespace and protection domains: The only thing standingNCVD-2021-004-infiniband-roce-memory-protectio · InfiniBand / RoCE memory protection - memory region rkey/lkey namespace and protection domainsHigh
• InfiniBand / RoCE memory protection - memory region rkey/lkey namespace and protection domains: The only thing standingNCVD-2021-010-infiniband-roce-memory-protectio · InfiniBand / RoCE memory protection - memory region rkey/lkey namespace and protection domainsHigh
• Dell EMC Integrated System for Microsoft Azure Stack Hub (undocumented iDRAC account): Dell shipped these integratedCVE-2021-21505 · Dell EMC Integrated System for Microsoft Azure Stack Hub (undocumented iDRAC account)High
• Dell iDRAC8 (local RACADM): An authenticated user injects commands through local RACADM and takes controlCVE-2024-25951 · Dell iDRAC8 (local RACADM)High