CVE-2026-91881: Dell Terraform Provider for Redfish, слаба

Описание

Оригинално описание

Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access. This is a Critical severity vulnerability as it allows an unauthenticated attacker to intercept all Redfish BMC traffic including credentials by performing a man-in-the-middle attack, since TLS certificate verification is unconditionally disabled in the base HTTP transport. Dell recommends customers to upgrade at the earliest opportunity.

Засегнати продукти

• Dell Terraform Provider for Redfish: преди 1.6.2 or later

Вид слабост

• CWE-295 Неправилна валидация на сертификат

История

Други уязвимости в Dell Terraform Provider for Redfish

• 4.3CVE-2026-76113

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-91881
• https://nvd.nist.gov/vuln/detail/CVE-2026-91881
• https://www.dell.com/support/kbdoc/en-in/000515444/dsa-2026-434-security-update-for-dell-terraform-provider-for-dell-server-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9