Dell Patches Critical CSM Flaws Enabling Admin Access and Root on Kubernetes Nodes
Summary
Six critical Dell CSM flaws could allow unauthenticated administrative access, credential theft, and root access to Kubernetes nodes. Dell says CSM 1.18.0 fixes the issues and recommends updating and rotating JWT signing secrets.
Key points
- Six vulnerabilities affect Dell Container Storage Modules (CSM); the article identifies versions before 1.17.0 as affected and 1.18.0 as fixed.
- Two unauthenticated flaws could bypass authorization and expose storage administrator credentials or grant administrative privileges.
- Hard-coded credentials and a JWT signing key could enable forged administrative tokens.
- Privilege escalation flaws could enable root access to Kubernetes nodes, cluster-wide access to Secrets, or unauthorized RBAC changes.
- Dell recommends updating to the latest version and rotating JWT signing secrets; no other workarounds or mitigations are available.
Article Details
- Vulnerability Types
- Missing authentication for critical function
- Improper privilege management
- Use of hard-coded credentials
- Use of hard-coded cryptographic key
- Improper neutralization of special elements used in a template engine
- Severity
- Critical; CVSS scores range from 9.6 to 10.0.
- Affected Versions
- Dell Container Storage Modules (CSM) versions prior to 1.17.0
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
CVE
Vendors
Products
Dell Container Storage ModulesDell has released updates for multiple critical flaws in Dell Container Storage Modules (CSM) that could let attackers bypass authentication, steal credentials, and gain administrative or root access across storageKubernetessteal credentials, and gain administrative or root access across storage infrastructure and Kubernetes clusters.