CVE-2026-91881: CWE-295: Improper Certificate Validation in Dell Terraform Provider for Redfish

Dell Terraform Provider for Redfish versions prior to 1.6.2 contain an improper certificate validation vulnerability (CWE-295) in the HTTP transport layer. TLS certificate verification is unconditionally disabled, enabling an unauthenticated attacker with network access to perform man-in-the-middle attacks and intercept sensitive Redfish BMC traffic, including credentials. This vulnerability is rated critical with a CVSS 3.1 score of 9.0, reflecting high impact on confidentiality, integrity, and availability. Dell advises upgrading to version 1.6.2 or later to fix this issue.

An unauthenticated remote attacker can exploit this vulnerability to intercept all Redfish BMC traffic, including sensitive credentials, by performing man-in-the-middle attacks due to disabled TLS certificate verification. This leads to information exposure and unauthorized access, severely compromising system security.

Dell recommends upgrading Dell Terraform Provider for Redfish to version 1.6.2 or later, where this improper certificate validation vulnerability is fixed. No other mitigations are specified. Patch status is not explicitly confirmed in the input data, but the vendor's upgrade recommendation indicates an official fix is available in version 1.6.2.