Dell OpenManage Ansible Modules: XML injection vulnerability (CVE-2026-91878)

Dell OpenManage Ansible Modules, specifically versions 6.0.0 through 10.0.3, contain an improper neutralization of special elements vulnerability within the XML data conversion component (CVE-2026-91878). This vulnerability allows a low-privileged attacker with remote access to perform XML injection attacks. Successful exploitation can lead to the injection of malicious content into XML structures and cause XML parsing errors, potentially impacting the integrity of downstream processes managed by these modules. No patch or fixed version is currently specified in the source material.

Impact

Exploitation of this vulnerability may result in unauthorized data manipulation within XML-based configurations or data streams handled by the affected Ansible modules, leading to potential service disruption or manipulation of managed Dell infrastructure settings.

Recommendation

• Audit environments using Dell OpenManage Ansible Modules versions 6.0.0 through 10.0.3 to identify exposed endpoints or automated workflows.
• Monitor logs for unusual XML input patterns or parsing error events originating from automated management tasks performed by these modules.
• Monitor vendor advisory channels for the release of an updated version of the affected Ansible modules that addresses this vulnerability.