Dell Container Storage Modules (CSM) before version 1.18.0 contain a missing authentication vulnerability (CWE-306). An unauthenticated attacker with network access to the affected CSM services can potentially gain elevated privileges. The CVSS score is 10.0 (critical). The exact affected component is not named in Dell's advisory; secondary sources point to the CSM Authorization proxy and tenant service, which manage access to storage arrays on Kubernetes or OpenShift.
Dell · Container Storage Modules
Dell Container Storage Modules (CSM) before version 1.18.0 contain a missing authentication vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker who can reach this service can obtain storage backend administrator credentials for all registered storage arrays. CSM is used to connect Dell storage arrays to Kubernetes and OpenShift clusters.
Dell · Container Storage Modules
Dell Container Storage Modules (CSM) before version 1.18.0 contain hard-coded credentials in the CSM Authorization component, which uses them for JWT authentication. An unauthenticated attacker with remote network access can use these credentials to forge tokens and gain elevated privileges, including control over the connected storage backend. The CVSS score is 9.8 (critical). Dell's advisory DSA-2026-448 covers several other CSM vulnerabilities fixed in the same update.
Dell · Container Storage Modules
Research and translation in progress – available shortly.