Dell iDRAC10 Telemetry Data Exposure

Executive summary #

The reduced-PII telemetry export on iDRAC10 includes fields that its configuration identifies for redaction, including SMTP credentials and personal or network-location data. An administrator configuring the export may therefore disclose those fields to the configured recipient. This vulnerability has an estimated CVSSv3.1 score of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N (2.7, Low), and is an instance of CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor) and CWE-522 (Insufficiently Protected Credentials).

Technical details #

The Sailfish metric-engine reads a blocked_properties_list_for_pii configuration intended to remove selected fields from reduced-PII Redfish-walk and telemetry-export output. The shipped configuration documents that this list is not applied because of a code bug. As a result, exported data may include the EventService SMTP username and password, SessionService client-origin IP address, manager MAC address, and Chassis location and postal address.

Attacker value #

An authenticated administrator who configures telemetry export can send the unredacted fields to the selected off-box recipient. The SMTP credentials are usable against the configured mail server; exposure of the other fields reveals personal, network, and physical-location information. The issue does not itself let an unauthenticated party retrieve the export.

Credit #

This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.

Timeline #

• 2026-07-16 (Thu): Initial findings discovered and documented
• 2026-07-21 (Tue): CVE-2026-65186 reserved
• 2026-08-27 (Thu): Vendor notified
• 2026-08-31 (Mon): Vendor acknowledged receipt, reserved CVE transferred
• 2026-10-26 (Mon): This public disclosure