Terraform Redfish Provider CVE-2026-91881

Exploitation requires the attacker to actively occupy a man-in-the-middle position on the network path between the system running the Dell Terraform Provider for Redfish and the target Redfish/BMC endpoint, and to be present while the provider is actively communicating with the BMC. No special product configuration is needed because TLS certificate verification is unconditionally disabled in the base HTTP transport of all versions prior to 1.6.2 - this is default behavior, not an opt-in setting. The principal limiting factors are the need for network-path interception (reflected in AC:H) and that impact is confined to windows when the provider initiates Redfish API traffic; deployments where provider-to-BMC traffic stays on trusted, isolated management segments face materially lower practical risk.

Signals point to a genuinely serious but condition-gated issue rather than a trivially mass-exploitable one. The vendor-supplied CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H (9.0 Critical) reflects an unauthenticated, network-reachable flaw with scope change (compromise of the Terraform provider's transport cascades into the Redfish/BMC it manages) and full confidentiality/integrity/availability impact. The key tempering factor is AC:H: because TLS certificate verification is unconditionally disabled, exploitation still requires the attacker to actively occupy a man-in-the-middle position on the traffic path between the provider and the BMC - this is not a fire-and-forget remote exploit. No EPSS score, CISA KEV entry, or POC indicator was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the Critical rating is driven by impact severity and the fact the weakness is present in default behavior, not by observed in-the-wild activity. Signals are internally consistent (AC:H matches a MITM-dependent CWE-295 flaw), so no contradictions require vendor verification, though the real-world priority depends heavily on whether provider-to-BMC traffic traverses untrusted network segments.

An attacker who can intercept traffic (e.g., on a shared management LAN, via ARP/DNS spoofing, or a compromised network device) between a host running the Dell Terraform Provider for Redfish and a target Dell server's BMC transparently relays the TLS session. Because certificate validation is unconditionally disabled in the base HTTP transport, the provider accepts the attacker's substituted certificate without warning, letting the attacker read and modify all Redfish traffic and harvest BMC credentials. No public exploit was identified at time of analysis, and the high attack complexity (AC:H) reflects the required man-in-the-middle positioning.