{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/openmanage-ansible-modules-6.0.0-through-10.0.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:dell:openmanage_ansible_modules:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.6,"id":"CVE-2026-91878"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenManage Ansible Modules (6.0.0 through 10.0.3)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","xml-injection","ansible"],"_cs_type":"advisory","_cs_vendors":["Dell"],"content_html":"\u003cp\u003eDell OpenManage Ansible Modules, specifically versions 6.0.0 through 10.0.3, contain an improper neutralization of special elements vulnerability within the XML data conversion component (CVE-2026-91878). This vulnerability allows a low-privileged attacker with remote access to perform XML injection attacks. Successful exploitation can lead to the injection of malicious content into XML structures and cause XML parsing errors, potentially impacting the integrity of downstream processes managed by these modules. No patch or fixed version is currently specified in the source material.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eExploitation of this vulnerability may result in unauthorized data manipulation within XML-based configurations or data streams handled by the affected Ansible modules, leading to potential service disruption or manipulation of managed Dell infrastructure settings.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit environments using Dell OpenManage Ansible Modules versions 6.0.0 through 10.0.3 to identify exposed endpoints or automated workflows.\u003c/li\u003e\n\u003cli\u003eMonitor logs for unusual XML input patterns or parsing error events originating from automated management tasks performed by these modules.\u003c/li\u003e\n\u003cli\u003eMonitor vendor advisory channels for the release of an updated version of the affected Ansible modules that addresses this vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T20:11:36Z","date_published":"2026-11-11T20:11:36Z","id":"https://feed.craftedsignal.io/briefs/2026-11-dell-openmanage-xml-injection-cve-2026-91878/","summary":"Dell OpenManage Ansible Modules versions 6.0.0 through 10.0.3 are vulnerable to XML injection in the XML data conversion component, allowing low-privileged remote attackers to inject malicious content or induce parsing errors.","title":"Dell OpenManage Ansible Modules: XML injection vulnerability (CVE-2026-91878)","url":"https://feed.craftedsignal.io/briefs/2026-11-dell-openmanage-xml-injection-cve-2026-91878/"}],"language":"en","title":"CraftedSignal Threat Feed - OpenManage Ansible Modules (6.0.0 Through 10.0.3)","version":"https://jsonfeed.org/version/1.1"}