Dell Patches Six Critical CSM Flaws That Could Give Attackers Admin Access
Summary
Dell patched six critical vulnerabilities in Container Storage Modules for Kubernetes, including flaws that could give unauthenticated attackers administrative control. Customers should upgrade to version 1.18.0 or later.
Key points
- Two flaws in Dell CSM Authorization could expose storage administrator credentials and allow attackers to bypass authorization.
- A separate flaw in the authorization proxy and tenant service could grant attackers administrative privileges.
- Four additional vulnerabilities could enable root access on cluster nodes, proxy administration, forged authentication tokens, or cluster-wide read access to Kubernetes Secrets.
- Dell recommends upgrading Container Storage Modules to version 1.18.0 or later as soon as possible.
- Dell has not flagged these vulnerabilities as actively exploited.
Article Details
- Vulnerability Types
- Missing authentication for critical functions
- Authorization bypass
- Hardcoded credentials
- Insufficient access control
- Severity
- Critical; two flaws are described as maximum severity.
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2021-21551For instance, the North Korean Lazarus hacking group deployed a Windows rootkit on victims’ systems by exploiting an insufficient access control vulnerability (CVE-2021-21551) in the Dell dbutil driver.CVE-2026-22769hacking group (UNC6201) had been exploiting a maximum-severity hardcoded-credential vulnerability (CVE-2026-22769) in Dell RecoverPoint for Virtual Machines since at least mid-2024 to deploy malware payloads andCVE-2026-54472root on cluster nodes (CVE-2026-67269), gain administrative access to the CSM Authorization proxy (CVE-2026-54472), forge authentication tokens to gain administrative privileges (CVE-2026-61421), and bypassCVE-2026-61421Authorization proxy (CVE-2026-54472), forge authentication tokens to gain administrative privileges (CVE-2026-61421), and bypass Kubernetes access controls for cluster-wide read access to Kubernetes SecretsCVE-2026-63688CVE-2026-63688 can expose storage backend administrator credentials and bypass authorization.CVE-2026-63692CVE-2026-63692 can let attackers gain admin privileges through the authorization proxy and tenant service.CVE-2026-67269issues that remote attackers can also exploit without privileges to gain root on cluster nodes (CVE-2026-67269), gain administrative access to the CSM Authorization proxy (CVE-2026-54472), forge authenticationCVE-2026-67273and bypass Kubernetes access controls for cluster-wide read access to Kubernetes Secrets (CVE-2026-67273).
Threat Actors
LazarusThe article says the group exploited CVE-2021-21551 to deploy a Windows rootkit.Silk TyphoonThe article describes this Chinese cyberespionage group as having reported overlaps with UNC6201.UNC6201A suspected Chinese state-backed group reported to have exploited CVE-2026-22769 since at least mid-2024.
Malware
SpawnantThe security researchers also found overlaps between UNC6201 and the Silk Typhoon Chinese cyberespionage group, known for targeting government agencies with custom Spawnant and Zipline malware in Ivanti zero-day attacks.ZiplineThe security researchers also found overlaps between UNC6201 and the Silk Typhoon Chinese cyberespionage group, known for targeting government agencies with custom Spawnant and Zipline malware in Ivanti zero-day attacks.
Vendors
Products
Container Storage Modules (CSM)Dell has patched two maximum severity vulnerabilities in the Container Storage Modules (CSM) that connect Dell enterprise storage arrays to Kubernetes environments.Dell dbutil driverFor instance, the North Korean Lazarus hacking group deployed a Windows rootkit on victims’ systems by exploiting an insufficient access control vulnerability (CVE-2021-21551) in the Dell dbutil driver.Dell RecoverPoint for Virtual Machinesbeen exploiting a maximum-severity hardcoded-credential vulnerability (CVE-2026-22769) in Dell RecoverPoint for Virtual Machines since at least mid-2024 to deploy malware payloads and create hidden network interfacesPowerFlexCSM supports Dell’s primary storage platforms (PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT), and it extends the capabilities of the standard Container Storage Interface (CSI) drivers for Kubernetes.PowerMaxCSM supports Dell’s primary storage platforms (PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT), and it extends the capabilities of the standard Container Storage Interface (CSI) drivers for Kubernetes.PowerScaleCSM supports Dell’s primary storage platforms (PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT), and it extends the capabilities of the standard Container Storage Interface (CSI) drivers for Kubernetes.PowerStoreCSM supports Dell’s primary storage platforms (PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT), and it extends the capabilities of the standard Container Storage Interface (CSI) drivers for Kubernetes.Unity XTCSM supports Dell’s primary storage platforms (PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT), and it extends the capabilities of the standard Container Storage Interface (CSI) drivers for Kubernetes.