Dell storage modules can hand over array admin with no login

If Dell Container Storage Modules sit between your Kubernetes cluster and the storage arrays, an unauthenticated caller can ask for the array admin passwords. Dell shipped the fixes in CSM 1.18.0 on October 2. There is no workaround, so this can’t wait for the next platform sprint.

No login, and the storage admin passwords come back.

Six critical CSM bugs, two with no authentication at all

Dell’s Container Storage Modules connect Power-family and other Dell arrays to Kubernetes. The Hacker News write-up of the October 2 updates lists six critical issues, two of them scored 10.0 because there is no authentication check at all.

CVE-2026-63688 is missing authentication on the csm-authorization-storage gRPC server. An unauthenticated remote attacker can retrieve storage-backend administrator credentials for every registered array. Dell’s own description, quoted in coverage of the advisory, is a complete bypass of the csm-authorization model across the supported Dell storage families.

CVE-2026-63692 is missing authentication on the authorization proxy and tenant service. It works the same way. With no login, an attacker gets administrative control of the authorization service and can reach storage across tenants.

The other four bugs make that foothold worse. CVE-2026-67269 (9.9) lets a low-privilege caller submit one ContainerStorageModule custom resource and reach root on cluster nodes. Dell says that can cover every node. CVE-2026-54472 and CVE-2026-61421 (both 9.8) are hard-coded credentials and a hard-coded JWT signing secret in karavi-authorization, so an attacker who knows the public secret can forge an admin token. CVE-2026-67273 (9.6) is template injection that can read Kubernetes Secrets cluster-wide and create cluster-scoped RBAC.

Dell says the flaws affect CSM before 1.17.0 and are addressed in 1.18.0, with no workaround other than the update. There is no public report of exploitation in the wild for this set as of this brief. It is on Monday’s list anyway, because storage admin credentials plus root on the nodes add up to control of the whole cluster.

The array password opens the volumes

Anyone who reads the array admin password can read the volumes. Root on a node, gained through a single custom resource, exposes every pod scheduled there. If your team files CSI drivers under platform work rather than security, this probably won’t show up in the app-sec queue.

Rotate secrets after you patch. Because the JWT key was hard-coded, a token minted before the upgrade can still be used until the signing secret changes.

Upgrade to 1.18.0, then rotate the secrets

• Find every cluster running Dell CSM, including labs that were promoted. kubectl get pods -A | grep -i csm is a starting point, but it won’t find everything.
• Upgrade CSM to 1.18.0 or later. Dell’s stated fix line is 1.18.0. Do not stop on 1.17.0.
• Rotate JWT signing secrets used by CSM Authorization, and rotate storage-array administrator credentials that the module could see.
• Review Kubernetes audit logs for unexpected ContainerStorageModule custom resources, new ClusterRoleBindings, and reads of Secrets from the CSM service accounts.
• If the authorization gRPC port was reachable beyond the cluster network, treat credential theft as plausible and rotate even if you see no logs.

Details

• Fixed release: Dell CSM 1.18.0 (October 2, 2026). Affected: versions before 1.17.0, per Dell as reported by The Hacker News. No workaround.
• CVE-2026-63688 — missing auth on csm-authorization-storage gRPC; unauthenticated retrieval of storage admin credentials. CVSS 10.0.
• CVE-2026-63692 — missing auth on the authorization proxy and tenant service; unauthenticated admin. CVSS 10.0.
• CVE-2026-67269 — ContainerStorageModule reconciler privilege bug; low-priv to root on nodes. CVSS 9.9.
• CVE-2026-54472 — hard-coded credentials; forge admin tokens. CVSS 9.8.
• CVE-2026-61421 — hard-coded JWT signing key in karavi-authorization. CVSS 9.8.
• CVE-2026-67273 — template injection; cluster Secret read and RBAC tampering. CVSS 9.6.
• Exploitation: not reported in the wild for this set as of October 4, 2026.

Hunt / verify

• Confirm the running CSM image tag is 1.18.0 or newer on every cluster, not just production.
• Confirm JWT signing secrets and array admin passwords were rotated after the upgrade, not before.
• Audit for ContainerStorageModule objects you did not create.

Dell CSM before 1.18.0: unauthenticated storage-admin credential leak plus a path to node root. Upgrade to 1.18.0, rotate JWT secrets and array admin passwords. CVE-2026-63688 and CVE-2026-63692 are the CVSS 10 pair.

Sources

• https://thehackernews.com/2026/10/dell-csm-flaws-enable-unauthenticated.html

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].