Database/Control plane, storage & DevOps
Dell OpenManage Ansible Modules: XML injection in the data conversion component
Impact
In the XML data conversion component of Dell's OpenManage Ansible modules, special elements in output passed to a downstream component are not neutralized. A low-privileged remote attacker can inject XML and malicious content, or cause XML parsing errors. The vendor rates the integrity impact high, which matters because the modules push configuration to iDRAC and OpenManage across the server fleet. The record does not say which downstream consumer receives the injected XML. This is a separate flaw from CVE-2026-91877, with a different component and a different affected version range.
Who can reach it
A remote attacker holding low-privilege credentials (PR:L, network). The record does not name the reachable interface.
What to do
Upgrade the OpenManage Ansible Modules collection on every Ansible controller and execution environment past 10.0.3, as directed in Dell DSA-2026-432. Versions 6.0.0 through 10.0.3 are affected, and the record does not state the fixed version. Only the automation hosts need the update, with no impact on managed nodes. Rebuild any pinned execution-environment images.
References
Related entries
- OpenZFS (sharenfs export generation): When an NFS share is exported to IPv6 addresses via sharenfs, OpenZFS silentlyCVE-2013-20001 · OpenZFS (sharenfs export generation)High
- ISC BIND: a single TKEY query trips a REQUIRE assertion and exits namedCVE-2015-5477 · ISC BIND named (TKEY query handling)High
- Ceph CephX authentication protocol: An attacker who sniffs the storage network can replay a CephX authenticationCVE-2018-1128 · Ceph CephX authentication protocolHigh
- Emerson/Vertiv Liebert IntelliSlot Web Card (config/configUser.htm, config/configTelnet.htm): The IntelliSlot cardCVE-2018-12922 · Emerson/Vertiv Liebert IntelliSlot Web Card (config/configUser.htm, config/configTelnet.htm)High
- ntpd (protocol engine, zero-origin timestamp): Continually sending packets with a zero-origin timestamp lets a remoteCVE-2018-7185 · ntpd (protocol engine, zero-origin timestamp)High
- Ceph RADOS Gateway (RGW, Beast frontend): An unauthenticated client can crash radosgw by sending valid headers followedCVE-2019-10222 · Ceph RADOS Gateway (RGW, Beast frontend)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.