Dell OpenManage Ansible Modules: OData filter injection allows unauthorized data access and authorization bypass

Impact

Dell's Ansible modules are used to automate iDRAC and OpenManage across a Dell server fleet. They do not neutralize special elements in the queries they build from OData filters, and a low-privileged remote attacker can use this to read data they should not see, bypass authorization, or cause a denial of service. The vendor rates the confidentiality impact high. The record does not say which managed endpoint or data the bypass reaches. Because these modules act on management controllers, any bypass of their filtering should be treated as exposure of fleet management data until the advisory says otherwise.

Who can reach it

A remote attacker holding low-privilege credentials (PR:L, network). The record does not name the reachable interface.

What to do

Upgrade the OpenManage Ansible Modules collection on every Ansible controller and execution environment past 10.0.3, as directed in Dell DSA-2026-432. Versions 2.0.2 through 10.0.3 are affected, and the record does not state the fixed version. Only the automation hosts need the update, with no drain or reboot of managed nodes. Rebuild any pinned execution-environment images.

References

Related entries

• Dell OpenManage Ansible Modules: XML injection in the data conversion componentCVE-2026-91878 · Dell OpenManage Ansible Modules (XML data conversion)High
• OpenZFS (sharenfs export generation): When an NFS share is exported to IPv6 addresses via sharenfs, OpenZFS silentlyCVE-2013-20001 · OpenZFS (sharenfs export generation)High
• ISC BIND: a single TKEY query trips a REQUIRE assertion and exits namedCVE-2015-5477 · ISC BIND named (TKEY query handling)High
• Ceph CephX authentication protocol: An attacker who sniffs the storage network can replay a CephX authenticationCVE-2018-1128 · Ceph CephX authentication protocolHigh
• Emerson/Vertiv Liebert IntelliSlot Web Card (config/configUser.htm, config/configTelnet.htm): The IntelliSlot cardCVE-2018-12922 · Emerson/Vertiv Liebert IntelliSlot Web Card (config/configUser.htm, config/configTelnet.htm)High
• ntpd (protocol engine, zero-origin timestamp): Continually sending packets with a zero-origin timestamp lets a remoteCVE-2018-7185 · ntpd (protocol engine, zero-origin timestamp)High