Dell Terraform Redfish Provider CVE-2026-91881: Improper Certificate Validation Enables MITM Credential Theft

Dell’s Terraform Provider for Redfish contains a flaw that disables security checks on network connections, allowing attackers to intercept sensitive data.

Root cause

The issue stems from improper certificate validation within the HTTP transport component of the software. According to the National Vulnerability Database, TLS certificate verification is unconditionally disabled in the base transport layer. This configuration means the provider does not verify the identity of the server it connects to, creating a gap in the security chain.

Attack path

An unauthenticated attacker with remote access can exploit this weakness by performing a man-in-the-middle attack. Because the software skips certificate checks, the attacker can position themselves between the provider and the target system. This allows them to intercept all Redfish Baseboard Management Controller traffic, including administrative credentials, leading to information exposure and unauthorized access.

Affected versions

The vulnerability impacts Dell Terraform Provider for Redfish in versions prior to 1.6.2. Users running any release older than this specific version are exposed to the risk of credential theft and traffic interception.

Mitigation

• Upgrade the Dell Terraform Provider for Redfish to version 1.6.2 or later.
• Dell recommends customers perform this upgrade at the earliest opportunity to close the security gap.

Why it matters

Teams usually rely on TLS to ensure that data sent between tools and infrastructure remains private and authentic. When certificate validation is skipped, the system cannot distinguish between a legitimate server and an impostor. This is similar to accepting a letter without checking the sender’s signature. Operators should check whether their automation pipelines verify server identities. If validation is disabled, any network observer can read or alter the data. Understanding this helps teams prioritise fixes that protect management credentials.

Background: National Vulnerability Database

The National Vulnerability Database provides standard identifiers for software flaws. You use these identifiers to automate patching and verify vendor claims. Small teams should cross-reference database entries with their IT asset inventory to prioritise fixes and avoid wasting time on irrelevant alerts.

Read the full guide: National Vulnerability Database: Small Business Action Plan

What to do and how to stay safe: Dell

• Inventory all instances of the Dell Terraform Provider for Redfish in your environment to identify affected versions.
• Monitor network logs for unusual traffic patterns or unexpected connections to Baseboard Management Controllers.
• Enforce strict network segmentation to limit remote access to management interfaces until updates are applied.
• Review Terraform configuration files to ensure no local overrides are disabling security checks or certificate validation.

Step-by-step guide: Security Advisories: 6 Common Misreadings That Leave Systems Exposed

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this vulnerability?

The vulnerability is tracked as CVE-2026-91881.

How severe is this flaw according to NVD?

The National Vulnerability Database rates the severity as critical with a CVSS score of 9.

Is there a fix available for this issue?

Yes, Dell recommends upgrading to version 1.6.2 or later to resolve the vulnerability.