Cybersecurity
Dell patches CSM vulnerabilities
Dell said six flaws in Container Storage Modules could let attackers bypass authentication, forge tokens and gain root or administrative access, and it said version 1.18.0 fixed them.
- Dell said it had released updates for Dell Container Storage Modules after identifying six vulnerabilities.
- The company said two flaws could let unauthenticated attackers bypass authentication and obtain administrative access, and one could let a low-privilege attacker gain root on cluster nodes.
- Dell said the flaws affected CSM versions before 1.17.0 and were fixed in 1.18.0.
- Dell recommended customers apply the updates and rotate JWT signing secrets, and said there were no workarounds apart from updating.
Dell said it had issued security updates for Dell Container Storage Modules after finding six vulnerabilities. It said the issues could allow unauthorised access to storage administration functions and, in one case, root access on cluster nodes.
For CVE-2026-63688, Dell said a flaw in the csm-authorization-storage gRPC server could let a remote attacker reach storage backend administrator credentials. For CVE-2026-63692, it said flaws in the authorisation proxy and tenant service could let an attacker bypass checks and obtain administrative privileges.
Dell said CVE-2026-67269 in the ContainerStorageModule Custom Resource reconciler could let a low-privilege attacker escalate to root on cluster nodes through a single custom resource submission. It also said CVE-2026-54472 in the CSM Authorization module could let an unauthenticated attacker forge administrative tokens, and CVE-2026-61421 in karavi-authorization used a hard-coded cryptographic key that could allow token forgery.
The company said CVE-2026-67273 in the JWT authentication component could permit privilege escalation, access to sensitive information and unauthorised RBAC changes. Dell said the flaws affected all versions before 1.17.0, were fixed in 1.18.0 and had no mitigation other than updating.
Named in this story
Companies
- Dell
- released the updates and issued the advisory
Products and systems
- Dell Container Storage Modules (CSM)
- the affected storage software suite
- csm-authorization-storage gRPC server
- contained a missing-authentication flaw
- authorization proxy and tenant service
- contained a missing-authentication flaw that could be used to gain administrative privileges
- ContainerStorageModule Custom Resource reconciler
- contained a privilege-management flaw
- CSM Authorization module
- contained hard-coded credentials
- karavi-authorization
- contained a hard-coded cryptographic key in its JWT authentication component
- CSM Authorization proxy
- was named as the target of token forgery and access-control bypass
- Kubernetes
- the cluster platform affected by the node-level escalation flaw
How the source tells it
The piece used a security-advisory register with repeated criticality claims and broad impact descriptions, so it read as urgent and alarming rather than neutral.
- alarm repeated severity labels and worst-case impact descriptions
- urgency a closing push to update immediately and rotate signing secrets
- threat inflation impact claims spread across all tenants, all nodes and all supported storage families