Dell Ansible Storage for Unity: REST connector skips certificate validation, exposing array credentials to MITM

Impact

The UnityRESTConnector in Dell's Ansible collection for Unity does not validate TLS certificates properly. Anyone in the network path can pose as the Unity array, capture the credentials the playbooks send, and alter responses. The record scores this as a scope change with high confidentiality and integrity impact, so captured credentials give management access to the Unity storage system itself.

Who can reach it

Anyone who can intercept traffic between the Ansible control node and the Unity array's REST API, usually on the storage management network. No authentication is needed, only that network position.

What to do

Upgrade the Dell Ansible Storage for Unity collection to 1.2.13 or later (DSA-2026-431). This is an upgrade on the Ansible control node with no array downtime. Rotate the Unity credentials the playbooks used over unverified connections.

References

Related entries

• GitLab CE/EE: stored XSS via crafted repository content in syntax-highlighted outputCVE-2026-92883 · GitLab CE/EE (syntax-highlighted blob rendering, HTML attribute sanitization)High
• HPE iLO3/4/5: Remote unauthenticated denial of service against the management controllerCVE-2018-7093 · HPE iLO3/4/5High
• NAKIVO Backup & Replication: Unauthenticated absolute path traversal via getImageByPathCVE-2024-48248 · NAKIVO Backup & ReplicationHigh
• Socomec DIRIS Digiware M-70 1.6.9 (Modbus TCP and Modbus RTU-over-TCP): A large cluster of unauthenticated ModbusCVE-2024-48882 · Socomec DIRIS Digiware M-70 1.6.9 (Modbus TCP and Modbus RTU-over-TCP)High
• GitHub Enterprise Server: DOM-based XSS in the Issues label filter escalates privilege in sudo modeCVE-2025-11892 · GitHub Enterprise Server (Issues search label filter)High
• Ivanti Connect Secure: authentication bypass by spoofing gives unauthenticated remote command executionCVE-2026-104935 · Ivanti Connect Secure (ICS) gatewayHigh