Dell CSM 1.18.0 Fixes Six Critical Vulnerabilities, Including Two CVSS 10.0 Flaws
Summary
Dell released CSM 1.18.0 to fix six critical vulnerabilities. Two unauthenticated flaws could enable network-reachable attackers to obtain storage administrator credentials or gain administrative access to connected resources.
Key points
- Dell advisory DSA-2026-448 and CSM 1.18.0 address six critical vulnerabilities.
- CVE-2026-63688 and CVE-2026-63692 each have a CVSS score of 10.0 and affect CSM Authorization components.
- An attacker with network access could exploit CVE-2026-63688 to retrieve administrator credentials for registered storage arrays without authentication.
- CVE-2026-63692 could allow an unauthenticated attacker with network access to bypass authentication and gain administrative privileges, potentially reaching other tenants' storage resources.
- The four other fixed flaws have CVSS scores from 9.6 to 9.9 and could enable outcomes including Kubernetes node root access, forged tokens, or access to Kubernetes Secrets.
- Dell CSM versions earlier than 1.18.0 should be upgraded to 1.18.0 or later; the article also recommends restricting access to Authorization services and reviewing or rotating exposed credentials and keys.
Article Details
- Vulnerability Types
- Missing authentication
- Improper privilege management
- Hard-coded credentials and cryptographic keys
- Authorization bypass
- Severity
- CVSS 10.0 for CVE-2026-63688 and CVE-2026-63692; CVSS 9.6–9.9 for the other four vulnerabilities
- Affected Versions
- Dell Container Storage Modules versions earlier than 1.18.0
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Limit network access to CSM Authorization services to approved cluster components and administrative systems.
- Review access to the csm-authorization-storage gRPC server, Authorization proxy, and tenant service for unintended exposure.
CVE
CVE-2026-63688The two most severe flaws, CVE-2026-63688 and CVE-2026-63692, were rated with Common Vulnerability Scoring System (CVSS) scores of 10.0.CVE-2026-63692The two most severe flaws, CVE-2026-63688 and CVE-2026-63692, were rated with Common Vulnerability Scoring System (CVSS) scores of 10.0.
Vendors
Products
Container Storage Modules (CSM)Dell released Container Storage Modules (CSM) 1.18.0 on October 1, 2026, to address six critical vulnerabilities affecting how Kubernetes environments connect to and manage Dell storage infrastructure.KubernetesDell released Container Storage Modules (CSM) 1.18.0 on October 1, 2026, to address six critical vulnerabilities affecting how Kubernetes environments connect to and manage Dell storage infrastructure.OpenShiftStorage Modules (CSM) is a specialized platform used by organizations running Kubernetes or Red Hat OpenShift environments alongside Dell storage platforms such as PowerStore, PowerScale, PowerFlex, PowerMax,PowerFlexor Red Hat OpenShift environments alongside Dell storage platforms such as PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT.PowerMaxHat OpenShift environments alongside Dell storage platforms such as PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT.PowerScaleKubernetes or Red Hat OpenShift environments alongside Dell storage platforms such as PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT.PowerStorerunning Kubernetes or Red Hat OpenShift environments alongside Dell storage platforms such as PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT.Unity XTenvironments alongside Dell storage platforms such as PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT.
Industries
Cloud infrastructureIt's most commonly found in cloud infrastructure, platform engineering, and data center environments that support business-critical applications and shared storage resources.Platform engineeringIt's most commonly found in cloud infrastructure, platform engineering, and data center environments that support business-critical applications and shared storage resources.