Dell iDRAC9 Redfish SSRF

Executive summary #

An iDRAC9 administrator who can create Redfish event subscriptions can cause the BMC to make redirected requests from its network position. This can expose services reachable by the BMC but not by the administrator's own system. This vulnerability has an estimated CVSSv3.1 score of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N (5.5, Medium), and is an instance of CWE-918 (Server-Side Request Forgery).

Technical details #

When an event is delivered, redfisheventservice issues an outbound request to the subscription's destination URL. The transfer does not constrain the protocols permitted when following a redirect, so a destination controlled by the attacker can reply with an HTTP 307 and a Location header pointing at an arbitrary host and scheme; the BMC follows it and issues the request to that target.

Attacker value #

An administrator with subscription-creation privileges could leverage the BMC's network position to reach internal services or services that trust requests originating from the BMC by converting the event-delivery client into a redirect-driven request forger. The request generated after the redirect is a GET, so the impact is limited to endpoints accessible through that HTTP method.

Credit #

This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.

Timeline #

• 2026-07-16 (Thu): Initial findings discovered and documented
• 2026-07-21 (Tue): CVE-2026-65186 reserved
• 2026-08-27 (Thu): Vendor notified
• 2026-08-31 (Mon): Vendor acknowledged receipt, reserved CVE transferred
• 2026-10-26 (Mon): This public disclosure