CVE-2026-91881
9.0CriticalPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-295
Impact
Unauthenticated network attackers in a man-in-the-middle position can intercept sensitive Redfish BMC traffic and credentials. They need network access between the Terraform runner and the target BMC to hijack the transport.
Root cause
The base HTTP transport unconditionally disables TLS certificate verification.
Affected systems
Dell Terraform Provider for Redfish prior to version 1.6.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade the Dell Terraform Provider for Redfish to version 1.6.2 or later; no temporary configuration workaround is documented.
$ terraform init -upgradeAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access. This is a Critical severity vulnerability as it allows an unauthenticated attacker to intercept all Redfish BMC traffic including credentials by performing a man-in-the-middle attack, since TLS certificate verification is unconditionally disabled in the base HTTP transport. Dell recommends customers to upgrade at the earliest opportunity.