Dell Terraform Provider for Redfish disables TLS certificate checks
Unpatched versions of the Dell Terraform Provider for Redfish skip TLS validation, allowing attackers to intercept BMC traffic and credentials.
Key points
- CVE-2026-91881 affects Dell Terraform Provider for Redfish versions prior to 1.6.2.
- The flaw is rated Critical with a CVSS score of 9 due to disabled certificate verification.
- Attackers can perform man-in-the-middle attacks to steal credentials and access systems.
The Dell Terraform Provider for Redfish contains a severe configuration error that disables TLS certificate verification. Environments using any version before 1.6.2 are exposed to immediate interception of management traffic. Security teams must assess their infrastructure for these older provider versions to prevent credential theft.
Root cause
The vulnerability stems from the HTTP transport component within the provider. According to the NVD record, the code unconditionally disables TLS certificate verification. This design choice creates an Improper Certificate Validation weakness, classified as CWE-295. The provider fails to validate the identity of the server it connects to, trusting any certificate presented during the handshake.
Attack path
An unauthenticated attacker with remote network access can exploit this flaw. By positioning themselves between the provider and the target, they can execute a man-in-the-middle attack. This allows the interception of all Redfish BMC traffic. Consequently, attackers can capture credentials and gain unauthorized access to the underlying hardware management interfaces.
Affected versions
- Dell Terraform Provider for Redfish versions prior to 1.6.2 are vulnerable.
- Version 1.6.2 and later contain the fix for this certificate validation issue.
Mitigation
- Upgrade the Dell Terraform Provider for Redfish to version 1.6.2 or later immediately.
- Audit infrastructure for any instances of older provider versions still in use.
- Restrict network access to Redfish endpoints to limit exposure to unauthenticated attackers.
Signals worth monitoring
Teams should inspect proxy logs for unexpected SSL termination or certificate errors originating from infrastructure automation tools. Look for connections to Redfish endpoints that do not match known IP addresses. Monitor for unusual authentication patterns or credential reuse across different management interfaces. If traffic inspection reveals unencrypted management data, isolate the affected automation runners immediately and rotate all associated BMC credentials.
Background: Man-in-the-middle attacks
Prevent man-in-the-middle attacks by enforcing strict certificate validation, disabling legacy protocols, and verifying domain ownership through DNSSEC. Use mutual authentication for internal services and monitor for unexpected certificate changes to stop interception attempts before data exfiltration occurs.
Read the full guide: Man-in-the-Middle Attack Prevention Checklist for Secure Connections
What to do and how to stay safe: Dell
- Inventory all Terraform configurations to identify usage of the Dell Redfish provider.
- Verify the installed version against the safe list provided by Dell.
- Update provider dependencies in your module registry or local cache.
- Review network logs for signs of man-in-the-middle activity on management ports.
Step-by-step guide: Stop Unauthorized Access: Practical Controls That Actually Work
General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-91881?
The Common Vulnerability Scoring System rate is 9, which is classified as Critical severity.
Which specific component is vulnerable?
The HTTP transport component within the Dell Terraform Provider for Redfish is affected.
Is there a patch available?
Yes, Dell recommends upgrading to version 1.6.2 or later to resolve the issue.
