Critical Dell Container Storage Flaws Expose Admin Controls

illustration of data center under attack with cracked padlock and hacker manipulating containers and Kubernetes

Dell’s Container Storage Modules (CSM) were found to contain multiple critical vulnerabilities that can allow unauthenticated remote attackers to gain full administrative control of affected storage environments. The most severe issues — two CVSS 10.0 flaws — permit attackers to bypass authentication and escalate to administrator privileges, while other high-severity flaws enable privilege escalation inside Kubernetes clusters or token forgery. Dell has released advisory DSA-2026-448 and fixed the issues in CSM 1.18.0 and later; organizations running earlier versions should treat this as an emergency and upgrade without delay.

What happened

Dell’s advisory covers a chain of flaws across the CSM stack — including CSM Authorization, CSM Operator, CSI drivers, and several third-party Go libraries — that together create a broad attack surface. Two vulnerabilities, CVE-2026-63688 and CVE-2026-63692, were assigned a maximum CVSS score of 10.0. CVE-2026-63688 is a missing authentication issue in the csm-authorization-storage gRPC server that could let unauthenticated actors obtain backend administrator credentials for registered arrays. CVE-2026-63692 affects the authorization proxy and tenant service and allows critical functionality to be reached without proper authentication, enabling administrative-level privilege escalation across tenants.

Key technical details

– Missing authentication (CVE-2026-63688): An unauthenticated request against the csm-authorization-storage gRPC endpoint can expose administrator credentials for storage arrays across Dell’s supported families. With those credentials an attacker could reconfigure arrays, extract data, or create persistent backdoors.

– Authorization bypass (CVE-2026-63692): The authorization proxy and tenant service expose functions that do not require authentication, permitting a network-based attacker to escalate privileges to administrator and manipulate storage resources across tenants.

– Hard-coded credentials and JWT forgery (CVE-2026-54472 and karavi-authorization): A hard-coded credential in CSM Authorization enables forging of cryptographically valid administrative JSON Web Tokens (JWTs). Dell also flagged older documentation that used the sample signing secret “supersecret”; deployments that left that value unchanged remain at risk. Dell recommends rotating JWT signing secrets after patching.

– Kubernetes-related escalation (CVE-2026-67269, CVE-2026-67273): A flaw in CSM Operator (rated 9.9) can let a low-privileged remote user gain root on Kubernetes nodes via malicious ContainerStorageModule resources. Another flaw (rated 9.6) can expose Kubernetes Secrets and allow creation of cluster-scoped RBAC via template-engine injection.

– Additional issues: improper certificate validation, missing authorization checks in various Dell CSI drivers (PowerMax, PowerFlex, PowerStore), sensitive information disclosure in logs, and vulnerabilities in third-party Go components (golang.org/x/crypto, golang.org/x/net, golang-jwt/jwt, protobuf) that broaden exploitation paths.

Impact and risk

These flaws collectively create a high-impact scenario. An unauthenticated attacker who exploits the highest-severity issues could achieve tenant-wide or cluster-wide administrative control, leading to data exfiltration, workload disruption, covert persistence, and downstream compromises of cloud and on-prem infrastructure. The Kubernetes-related vulnerabilities further raise the stakes by enabling lateral movement from the CSM layer into cluster core services and nodes. Because some issues allow exploitation without authentication and no mitigations were provided by Dell, affected environments are at immediate risk until patched.

Immediate actions for defenders

– Upgrade immediately: Deploy CSM version 1.18.0 or later across all affected components (CSM Authorization, CSM Operator, CSI drivers). Dell indicates no effective workarounds.

– Rotate JWT signing secrets: After patching, rotate any JWT signing keys used by CSM Authorization and karavi-authorization deployments, and invalidate any tokens issued under prior secrets.

– Audit and investigate: Review CSM Authorization and operator access logs for signs of unauthorized administrative token use or suspicious gRPC requests. Look for anomalous array access, configuration changes, or unexplained creation of ContainerStorageModule resources.

– Review Kubernetes RBAC and Secrets: Audit cluster-scoped RBAC bindings, custom resources, and Secret access patterns for unauthorized changes. Treat any unexpected cluster-scoped RBAC resources or new admin-level bindings as indicators of compromise.

– Rotate backend credentials and keys: If administrator credentials for storage arrays could have been exposed, rotate them and verify storage-array configurations and access lists.

– Patch dependencies: Update third-party Go libraries and components used by your CSM deployments to versions that resolve the referenced vulnerabilities.

Longer-term recommendations

– Harden authentication and token management: Enforce least-privilege for components interacting with storage APIs, require mutual TLS where possible, and use short-lived tokens with strong signing secrets stored in secure vaults.

– Improve supply-chain hygiene: Track and manage third-party dependencies, subscribe to vendor advisories, and perform regular dependency scans to catch vulnerable libraries early.

– Tighten Kubernetes admission and validation: Use admission controllers, PodSecurityPolicies (or their replacements), and validating webhooks to restrict creation of privileged custom resources and block unexpected template-engine inputs.

– Run regular threat-hunting and integrity checks: Include storage controllers and operator components in SOC playbooks and run periodic integrity scans for configuration drift and unauthorized objects.

– Document and test incident response: Ensure runbooks cover token compromise, storage credential rotation, and recovery from operator-level root compromises.

Conclusion

Dell’s CSM advisory underscores how vulnerabilities in control-plane components and operator tooling can rapidly escalate into full administrative takeover of storage and Kubernetes resources. Because several of the most severe issues allow unauthenticated access and Dell provides no mitigations beyond patching, organizations must treat this as an urgent patch-and-respond event: upgrade to CSM 1.18.0+, rotate JWT and administrative secrets, audit logs and RBAC, and harden cluster admission controls to reduce the blast radius of future flaws.