Dell CSM Critical Flaws: Unauthenticated Admin on Kubernetes Nodes

Dell has issued urgent security updates for its Container Storage Modules (CSM), addressing a suite of critical vulnerabilities that could grant unauthenticated attackers full administrative control over connected storage infrastructure and compromise Kubernetes clusters. These flaws, affecting all CSM versions prior to 1.17.0, include serious authentication bypasses and capabilities for remote code execution within Kubernetes environments. Organizations leveraging Dell CSM for their containerized workloads are strongly advised to update immediately to version 1.18.0 and rotate JWT signing secrets to prevent potential system takeovers, as highlighted by The Hacker News.

Technical Details of Dell CSM Vulnerabilities

The collection of vulnerabilities in Dell CSM presents a significant threat due to their potential for unauthenticated access and high-level system compromise. Dell has acknowledged the severity, classifying several of these as critical.

Key Vulnerabilities and Their Impact

• CVE-2026-63688: Critical Authorization Bypass This vulnerability is considered critical as it enables a complete bypass of the csm-authorization security model. An attacker exploiting this flaw can gain full administrative control over the storage infrastructure, impacting all five supported Dell storage product families. This means an unauthenticated actor could manage and manipulate storage resources without proper authorization.

• CVE-2026-63692: Unauthenticated Administrative Control Successful exploitation of this flaw allows an unauthenticated attacker to achieve complete administrative control over the authorization service itself. This grants them the ability to access or manipulate storage resources across all tenants connected to the Dell CSM environment.

• CVE-2026-67269: Kubernetes Node Compromise This vulnerability is particularly concerning for environments using Kubernetes. An attacker can exploit this flaw to compromise all nodes within a Kubernetes cluster through a single custom resource submission. This provides a direct path to an unauthenticated Kubernetes cluster compromise in Dell CSM, allowing widespread unauthorized access and control.

• CVE-2026-54472: CSM Authorization Proxy Bypass This vulnerability can be weaponized to sidestep authentication controls for the CSM Authorization proxy. Consequently, it enables unauthorized management of storage access policies across all connected tenants, potentially leading to data exfiltration or manipulation.

• CVE-2026-67273: Kubernetes Access Control Bypass Exploitation of this vulnerability grants an attacker cluster-wide read access to Kubernetes Secrets. Furthermore, it allows them to create cluster-scoped Role-Based Access Control (RBAC) resources, effectively bypassing the intended Kubernetes access controls and escalating privileges within the cluster.

Impact and Context for Defenders

The presence of multiple critical vulnerabilities allowing unauthenticated access and administrative control signifies a severe risk. Given that Dell CSM integrates with Kubernetes, these flaws expose critical infrastructure components. The ability to gain administrative control over storage infrastructure or compromise Kubernetes nodes means attackers could:

• Access, modify, or delete sensitive data stored on Dell storage systems.
• Disrupt containerized applications and services.
• Establish persistence within the Kubernetes cluster.
• Exfiltrate sensitive information, including Kubernetes Secrets.

Dell’s previous vulnerabilities, such as CVE-2021-21551 and CVE-2026-22769, have seen active exploitation in the past, underscoring the urgency for immediate patching. Organizations should consider these new CSM vulnerabilities a high-priority threat.

Prioritising Remediation: Dell CSM Versions Prior to 1.17.0 Patching

For security professionals managing Dell Container Storage Modules, immediate action is imperative. The current situation demands a prompt response to safeguard critical infrastructure.

Actionable Recommendations and Mitigations

Defenders should prioritize the following actions to address these critical vulnerabilities:

• Immediate Update: The most critical step is to update all instances of Dell Container Storage Modules (CSM) to version 1.18.0 or later. Dell explicitly states that there are no workarounds or alternative mitigations apart from applying the update. This update directly addresses all the identified flaws.
• Rotate JWT Signing Secrets: Following the update, organizations must rotate any JSON Web Token (JWT) signing secrets. This step is crucial to invalidate any potentially compromised tokens that an attacker might have acquired before the patch was applied, preventing continued unauthorized access.
• Network Segmentation and Least Privilege: While not direct mitigations for these specific flaws, maintaining strong network segmentation and enforcing the principle of least privilege for all users and services interacting with Dell CSM and Kubernetes environments can limit the blast radius of future attacks.
• Monitor Kubernetes Audit Logs: Enhance monitoring for unusual activity within Kubernetes audit logs, particularly focusing on create and update operations related to RBAC resources and access to Secrets. Early detection can be key to responding to exploitation attempts.
• Mitigation for Dell CSM CVE-2026-63688: The primary mitigation for this and related flaws is the immediate application of Dell CSM version 1.18.0.

This approach ensures the system is secured against the identified vulnerabilities and minimizes the potential for future compromise.

Related: CVE-2026-90970: GitLab AI Gateway RCE Flaw — Update Self-Hosted Now, MikroTik RouterOS Critical Flaws Chained to Hack Routers