Dell OpenManage Ansible Modules: iDRAC connections skip TLS certificate validation

Impact

The Ansible collection used to automate Dell iDRAC BMCs fails to validate TLS certificates when it connects to them. Dell's advisory DSA-2026-432 splits this across 3 ids, one for each client component: iDRACRedfishAPI (versions 2.1.2 to 10.0.3), iDRACConnection (5.0.0 to 10.0.3) and SessionAPI (9.2.0 to 10.0.3). An attacker who can sit between the Ansible controller and the iDRACs can capture the BMC credentials and the session data the playbooks send, which leads to information exposure and unauthorized access. On a GPU fleet built on Dell PowerEdge servers, iDRAC credentials give out-of-band control of the node: power, firmware, virtual media and console. One playbook run can expose credentials for many BMCs at once.

Who can reach it

A network attacker positioned on the path between the Ansible control host and the iDRAC management interfaces, for example on the management VLAN. No authentication is needed. Attack complexity is high because the attacker has to intercept the traffic.

What to do

Upgrade the dellemc.openmanage Ansible collection on every automation controller and execution environment to the fixed release named in DSA-2026-432 (the affected range ends at 10.0.3). This only touches the controller: no node drain or reboot is needed. If playbooks ran against iDRACs over a network you do not trust, consider rotating the iDRAC credentials they used.

Also covers 2 CVEs

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

References

Related entries

• Cisco FXOS / NX-OS AAA: AAA implementation flaw enabling remote DoS via brute-force login attempts against the switchCVE-2017-3883 · Cisco FXOS / NX-OS AAAHigh
• Cisco NX-OS PTP feature (Nexus 5500/5600/6000): An unauthenticated remote attacker takes down a Nexus switch throughCVE-2018-0378 · Cisco NX-OS PTP feature (Nexus 5500/5600/6000)High
• Cisco NX-OS (VXLAN OAM / NGOAM): A crafted VXLAN OAM packet reloads a VTEP. In a VXLAN/EVPN GPU fabric every leaf is aCVE-2021-1587 · Cisco NX-OS (VXLAN OAM / NGOAM)High
• Intel Ethernet Adapter manageability firmware (NC-SI / sideband path): Improper input validation in the *manageability*CVE-2021-33141 · Intel Ethernet Adapter manageability firmware (NC-SI / sideband path)High
• GRUB2 (font engine, grub_font_construct_glyph): Buffer overflow when constructing a glyph from a crafted GRUB fontCVE-2022-2601 · GRUB2 (font engine, grub_font_construct_glyph)High
• Intel AMT / Standard Manageability firmware: Improper input validation in AMT/ISM firmware, scored high becauseCVE-2022-36392 · Intel AMT / Standard Manageability firmwareHigh