OpenManage Ansible Modules (2.0.2-10.0.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/openmanage-ansible-modules-2.0.2-10.0.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 22:09:37 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDell OpenManage Ansible Modules: Improper Neutralization of Data Query Logic (CVE-2026-91877)https://feed.craftedsignal.io/briefs/2026-11-dell-openmanage-ansible-cve-2026-91877/Wed, 11 Nov 2026 22:09:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-dell-openmanage-ansible-cve-2026-91877/Dell OpenManage Ansible Modules versions 2.0.2 through 10.0.3 contain an improper neutralization vulnerability in OData filter processing, allowing low-privileged attackers to bypass authorization, access unauthorized data, or cause a denial of service.Dell OpenManage Ansible Modules, specifically versions 2.0.2 through 10.0.3, are affected by an Improper Neutralization of Special Elements in Data Query Logic vulnerability (CVE-2026-91877). The vulnerability exists within the OData filter processing component. A remote attacker with low privileges can exploit this flaw to bypass authorization, gain unauthorized access to sensitive data, or trigger a denial-of-service condition. The vulnerability has a CVSS v3.1 base score of 7.6.

Impact

Successful exploitation allows unauthorized users to perform unauthorized data access, bypass authorization controls, and potentially disrupt service availability. The impact is primarily on the integrity and confidentiality of the systems managed by the affected Dell modules.

Recommendation

  • Identify all instances of Dell OpenManage Ansible Modules in the environment that fall within the vulnerable range (2.0.2 to 10.0.3).
  • Prioritize applying security updates provided by Dell to patch CVE-2026-91877 across all infrastructure-as-code and orchestration pipelines.
  • Restrict access to systems utilizing these modules to only trusted, authorized users to mitigate the risk from low-privileged exploitation until patching is complete.
]]>mediumadvisory