Dell iDRAC Redfish SQL Injection

Executive summary #

An authenticated Redfish user with the lowest Login privilege can inject SQL through the OData $filter operand on iDRAC9 and iDRAC10. This vulnerability has an estimated CVSSv3.1 score of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (6.5, Medium), and is an instance of CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Technical details #

The legacy fcgi-rfsql component inserts the $filter operand directly into a SQL WHERE clause without binding or escaping it. Its filter-specific input check allows characters needed to break out of a quoted value, while a stricter check in the same component is applied only to a different request path. The OData translation maps operators but does not make the operand safe. This vulnerable path is present on both iDRAC9 7.20.10.50 and iDRAC10 1.30.10.50.

Attacker value #

An authenticated low-privilege user can use the injection to retrieve data from the Redfish backing store beyond the account's authorization scope. On iDRAC9, the affected query is executed as a single prepared statement, limiting that path to read-side injection rather than stacked writes.

Credit #

This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.

Timeline #

• 2026-07-16 (Thu): Initial findings discovered and documented
• 2026-07-21 (Tue): CVE-2026-65186 reserved
• 2026-08-27 (Thu): Vendor notified
• 2026-08-31 (Mon): Vendor acknowledged receipt, reserved CVE transferred
• 2026-10-26 (Mon): This public disclosure