CVE-2026-54794 Overview
CVE-2026-54794 is a Server-Side Request Forgery (SSRF) vulnerability in Dell OpenManage Enterprise versions prior to 4.7.0. An unauthenticated remote attacker can exploit the flaw to coerce the server into issuing arbitrary HTTP requests. Successful exploitation leads to information exposure from internal systems and services reachable by the OpenManage Enterprise host.
The issue is tracked as CWE-918: Server-Side Request Forgery and is addressed in Dell advisory DSA-2026-359.
Critical Impact
Unauthenticated attackers with network access to OpenManage Enterprise can pivot requests through the appliance to internal endpoints, exposing sensitive metadata and services otherwise inaccessible from the outside.
Affected Products
- Dell OpenManage Enterprise versions prior to 4.7.0
Discovery Timeline
- 2026-08-19 - CVE-2026-54794 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-54794
Vulnerability Analysis
Dell OpenManage Enterprise is a systems management console used to monitor and administer Dell server infrastructure. The vulnerability allows an unauthenticated attacker to submit a crafted request that causes the application to fetch a URL of the attacker's choosing. Because the fetch executes from the server, it bypasses network boundaries that would normally block external requests.
The attack requires no privileges and no user interaction, and it can be triggered over the network. The impact centers on confidentiality and integrity of data returned or altered through the coerced request, with information exposure being the primary outcome documented by Dell.
Root Cause
The root cause is missing validation of user-supplied URLs or hostnames before the server issues an outbound request. The application does not restrict destination schemes, hosts, or IP ranges. Attackers can therefore target loopback interfaces, link-local metadata endpoints, or other internal services trusted by the OpenManage Enterprise host.
Attack Vector
Exploitation occurs over the network against the OpenManage Enterprise web interface. An attacker submits a request containing a URL parameter that references an internal resource. The server processes the request and returns, reflects, or acts on the response content. See the Dell advisory DSA-2026-359 for technical details.
No verified public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-54794
Indicators of Compromise
- Outbound HTTP or HTTPS requests originating from the OpenManage Enterprise host to internal RFC1918 addresses, 127.0.0.1, or cloud metadata endpoints such as 169.254.169.254.
- Unexpected traffic from OpenManage Enterprise to internal services it does not normally communicate with, such as databases, admin consoles, or Kubernetes APIs.
- Web server access logs showing requests to OpenManage Enterprise endpoints containing URL, host, or target parameters supplied by external clients.
Detection Strategies
- Inspect application logs for request parameters carrying URLs, IP addresses, or hostnames sent to management API endpoints prior to patch 4.7.0.
- Correlate inbound requests to the OpenManage Enterprise console with subsequent outbound connections from the same host within a short time window.
- Alert on any request from the OpenManage Enterprise service account destined for cloud instance metadata services or loopback ports.
Monitoring Recommendations
- Enable and forward OpenManage Enterprise application, access, and audit logs to a centralized SIEM for correlation.
- Baseline expected outbound destinations for the OpenManage Enterprise host and alert on deviations.
- Monitor for repeated unauthenticated requests to management endpoints, which may indicate scanning or exploitation attempts.
How to Mitigate CVE-2026-54794
Immediate Actions Required
- Upgrade Dell OpenManage Enterprise to version 4.7.0 or later as directed in DSA-2026-359.
- Restrict network access to the OpenManage Enterprise management interface to trusted administrative networks only.
- Review recent access logs for suspicious requests carrying URL or host parameters from untrusted sources.
Patch Information
Dell has released a fixed version in OpenManage Enterprise 4.7.0. Administrators should follow the upgrade instructions in the vendor advisory DSA-2026-359 and verify the installed build after patching.
Workarounds
- Place the OpenManage Enterprise console behind a firewall or VPN and deny direct access from untrusted networks until patching is complete.
- Apply egress filtering on the OpenManage Enterprise host to block outbound connections to loopback, link-local, and internal ranges that the appliance does not require.
- Disable or restrict any optional integration features that accept remote URLs as input where operationally feasible until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
