CVE-2026-91881
Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access. This is a Critical severity vulnerability as it allows an unauthenticated attacker to intercept all Redfish BMC traffic including credentials by performing a man-in-the-middle attack, since TLS certificate verification is unconditionally disabled in the base HTTP transport. Dell recommends customers to upgrade at the earliest opportunity.
CVE-2026-91881
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-91881
Terraform Provider for Redfish
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Dell",
"product": "Terraform Provider for Redfish",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.6.2 or later",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-91881
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #28853 · Revision 1
- Added to Heist Feed
- Publisher date