Dell OpenManage Ansible Modules: Improper Neutralization of Data Query Logic (CVE-2026-91877)

Dell OpenManage Ansible Modules, specifically versions 2.0.2 through 10.0.3, are affected by an Improper Neutralization of Special Elements in Data Query Logic vulnerability (CVE-2026-91877). The vulnerability exists within the OData filter processing component. A remote attacker with low privileges can exploit this flaw to bypass authorization, gain unauthorized access to sensitive data, or trigger a denial-of-service condition. The vulnerability has a CVSS v3.1 base score of 7.6.

Impact

Successful exploitation allows unauthorized users to perform unauthorized data access, bypass authorization controls, and potentially disrupt service availability. The impact is primarily on the integrity and confidentiality of the systems managed by the affected Dell modules.

Recommendation

• Identify all instances of Dell OpenManage Ansible Modules in the environment that fall within the vulnerable range (2.0.2 to 10.0.3).
• Prioritize applying security updates provided by Dell to patch CVE-2026-91877 across all infrastructure-as-code and orchestration pipelines.
• Restrict access to systems utilizing these modules to only trusted, authorized users to mitigate the risk from low-privileged exploitation until patching is complete.