Dell has issued a critical security advisory impacting its Container Storage Modules (CSM), warning that multiple severe vulnerabilities could let unauthenticated attackers gain complete administrative control of affected storage infrastructures. Users of vulnerable Dell CSM deployments are urged to update immediately, as no interim workarounds or mitigations exist.
What’s at Risk
The flaws affect CSM versions earlier than 1.17.0, with patches implemented in version 1.18.0 and above covering CSM Authorization, CSM Operator, CSI components, and related third-party Go libraries.
The most dangerous bugs are CVE-2026-63688 and CVE-2026-63692, both rated CVSS 10.0. The first is an authentication-missing issue in the csm-authorization-storage gRPC server which could expose administrator credentials across all storage arrays supported by Dell. The second allows bypassing authentication in vital services like the authorization proxy and tenant service—enabling privilege escalation to admin level.
Another major concern is CVE-2026-54472, where hard-coded credentials in CSM Authorization let attackers forge valid administrative JSON Web Tokens. Dell urges impacted organizations to rotate JWT signing secrets after updating to fix this. Also exposed are environments using a documented but weak JWT secret (“supersecret”) from older documentation of karavi-authorization, which—if never changed—could grant attackers full administrative control over the CSM Authorization proxy.
Additional Vulnerabilities & Associated Risks
CSM Operator 1.12.0 is vulnerable via CVE-2026-67269, which could allow low-privileged remote users to gain root access to Kubernetes nodes through malicious ContainerStorageModule resources—potentially compromising entire clusters. Rated 9.9 in severity.
CVE-2026-67273, rated 9.6, enables low-privileged attackers to access Kubernetes Secrets and create cluster-wide RBAC resources. This occurs via template-engine injection, potentially bypassing built-in permissions and enabling broad control over cluster resources.
Other issues include: improper certificate validation; missing authorization in Dell’s CSI Driver for PowerMax; exposure of sensitive info through logs; and flaws affecting CSI drivers for PowerFlex, PowerMax, and PowerStore. In addition, several third-party Go components like golang.org/x/crypto, golang.org/x/net, golang-jwt/jwt, and protobuf also contain vulnerabilities now addressed by Dell.
What Organizations Should Do Now
Dell is advising all affected CSM deployments to upgrade to version 1.18.0 or newer without delay. Organizations should also rotate JWT signing keys, review access logs tied to CSM Authorization, audit administrative token operations, and verify Kubernetes RBAC policies and custom resources for unauthorized activity.
This advisory highlights how container storage infrastructure—increasingly vital in cloud native environments—can become a major attack vector if critical components like authorization and secrets handling are not rigorously secured. As enterprise IT continues moving toward containerization, here are the key takeaways:
Why this matters:Unauthenticated full administrative access in storage layers can lead to catastrophic impacts ranging from data theft and unauthorized configuration changes, to lateral movement across infrastructure and persistent compromise.
What to watch:How quickly organizations apply patches and rotate credentials; whether further vulnerabilities emerge in related CSI drivers or third-party libraries; and how vendor documentation and default configurations may unintentionally introduce weak points.
