Dell Container Storage Modules: Hard-coded credentials in CSM Authorization
Summary
Dell Container Storage Modules (CSM) before version 1.18.0 contain hard-coded credentials in the CSM Authorization component, which uses them for JWT authentication. An unauthenticated attacker with remote network access can use these credentials to forge tokens and gain elevated privileges, including control over the connected storage backend. The CVSS score is 9.8 (critical). Dell's advisory DSA-2026-448 covers several other CSM vulnerabilities fixed in the same update.
Affected
- Dell Container Storage Modules versions prior to 1.18.0
- Component: CSM Authorization (karavi-authorization)
Fixed in
- Upgrade to Dell Container Storage Modules 1.18.0 or later
- Dell advisory DSA-2026-448 (released October 1, 2026, per Dell and third-party sources)
Workaround
- Unknown. Dell lists no workarounds; upgrading is the only fix.
- After upgrading, rotate the JWT signing secret used by CSM Authorization.
- If the service was reachable from untrusted networks, rotate the storage array administrator credentials registered with CSM Authorization.
Exploitation
- No known exploitation at the time of writing; not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- VulDB reports no public exploit available. A secondary source claims the signing key is publicly documented in legacy deployments; this is unconfirmed.
Our recommendation
- Patch Dell Container Storage Modules to 1.18.0 or later, applying the full DSA-2026-448 update.
- Rotate the JWT signing secret and storage array administrator credentials after patching.
- Check whether CSM Authorization or gRPC/proxy endpoints are reachable from untrusted networks and restrict access.
- Review authorization proxy logs for unexplained administrative activity.
- Priority: high for any organisation running affected CSM with Dell storage and Kubernetes or OpenShift.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell DSA-2026-448 www.dell.com
- University of Toronto security advisory security.utoronto.ca
- Field Effect advisory summary fieldeffect.com
- CISA SSVC via OpenCVE app.opencve.io
- VulDB vuldb.com
- OSV osv.dev
- Vulners NVD mirror vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:07.
Original description (NVD)
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.