Dell iDRAC10 Redfish SQL Injection

Executive summary #

An authenticated Redfish user with the lowest Login privilege can inject SQL through a resource-ID path segment on iDRAC10. The vulnerable provider builds queries by inserting decoded path segments into SQL string literals without escaping or binding them. This vulnerability has an estimated CVSSv3.1 score of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (6.5, Medium), and is an instance of CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Technical details #

The libgenericSqlToJson-provider, loaded by fcgiodata, concatenates resource-ID segments into Id="..." and enclosure LIKE predicates. A double quote in a percent-decoded path segment can terminate the string literal and alter the SQL predicate. Although the query is compiled with SQLite's prepared-statement API, the tainted segment is part of the SQL text rather than a bound parameter. The enclosure predicate is evaluated during collection processing before the per-resource READ authorization check, so the injection does not require read access to the targeted resource.

Attacker value #

An authenticated user can use boolean-blind or UNION-based injection to read data from SQLite-backed Redfish materialized views beyond the account's authorization scope. The flaw is read-side only: it does not enable stacked statements, writes, or ATTACH through this request path.

Credit #

This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.

Timeline #

• 2026-07-16 (Thu): Initial findings discovered and documented
• 2026-07-21 (Tue): CVE-2026-65186 reserved
• 2026-08-27 (Thu): Vendor notified
• 2026-08-31 (Mon): Vendor acknowledged receipt, reserved CVE transferred
• 2026-10-26 (Mon): This public disclosure