CVE-2026-91881 in Terraform Provider for Redfish
Summary
by MITRE • 10/14/2026
Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access. This is a Critical severity vulnerability as it allows an unauthenticated attacker to intercept all Redfish BMC traffic including credentials by performing a man-in-the-middle attack, since TLS certificate verification is unconditionally disabled in the base HTTP transport. Dell recommends customers to upgrade at the earliest opportunity.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The Dell Terraform Provider for Redfish versions prior to 1.6.2 contains a critical security flaw classified as Improper Certificate Validation within its HTTP transport layer. This vulnerability stems from an unconditional disabling of TLS certificate verification, which fundamentally undermines the integrity and confidentiality of communications between infrastructure-as-code tools and remote management controllers. By failing to validate the server's digital identity during the handshake process, the provider creates a severe trust deficit that allows any network actor capable of intercepting traffic to impersonate the target system without detection. This architectural oversight transforms what should be a secure encrypted channel into an open conduit for eavesdropping and manipulation, exposing sensitive operational data to malicious actors with remote access capabilities.
From a technical perspective, the root cause lies in the configuration of the underlying HTTP client used by the Terraform provider. When establishing connections to Redfish-enabled Baseboard Management Controllers or similar hardware interfaces, the software does not perform standard certificate chain validation against trusted Certificate Authorities nor does it verify that the presented certificate matches the expected hostname. This behavior effectively bypasses Transport Layer Security protections designed to prevent man-in-the-middle attacks. An attacker positioned on the network path can intercept these connections and present a fraudulent certificate signed by a self-signed or untrusted authority, which the vulnerable provider will accept without question. Consequently, all data transmitted over this channel, including authentication credentials, session tokens, and configuration commands, is exposed in plaintext to anyone monitoring the traffic stream.
The operational impact of this vulnerability is severe due to its critical severity rating. Because Redfish interfaces often provide administrative control over hardware components such as power states, firmware updates, and BIOS settings, successful exploitation allows an unauthenticated attacker to gain unauthorized access to these systems. The ability to intercept credentials enables credential theft, which can be leveraged for lateral movement within the enterprise network or persistent backdoor installation. Furthermore, the lack of mutual authentication means that attackers can also inject malicious commands into the communication stream, potentially leading to system compromise, data exfiltration, or denial of service conditions by altering firmware configurations or triggering hardware faults remotely. This represents a significant risk to infrastructure integrity and compliance with security standards requiring secure remote management practices.
This vulnerability aligns closely with Common Weakness Enumeration identifier CWE-295 Improper Certificate Validation, which describes failures in verifying the authenticity of certificates used for authentication over network connections. Additionally, it maps directly to MITRE ATT&CK technique T1078 Valid Accounts and specifically supports man-in-the-middle attack vectors such as T1557 Adversary-in-the-Middle where an attacker intercepts communication between two parties who believe they are directly communicating with each other. The exploitation of this flaw facilitates unauthorized access by bypassing authentication mechanisms that rely on the security of the transport layer, thereby compromising the confidentiality and integrity of administrative operations managed through Terraform automation pipelines.
To mitigate this risk, Dell recommends upgrading to version 1.6.2 or later of the Terraform Provider for Redfish as soon as possible. This update restores proper certificate validation logic within the HTTP transport component, ensuring that TLS connections are only established with servers presenting valid and trusted certificates. Organizations should also implement network segmentation strategies to restrict access to management interfaces like Redfish from untrusted networks, thereby reducing the attack surface available for man-in-the-middle attacks. Additionally, security teams should audit their Terraform configurations to ensure no other providers or custom scripts have disabled certificate verification in similar contexts, maintaining a consistent posture of secure communication across all infrastructure automation workflows until full remediation is achieved.