Dell Container Storage Modules: Missing authentication for critical function
Summary
Dell Container Storage Modules (CSM) before version 1.18.0 contain a missing authentication vulnerability (CWE-306). An unauthenticated attacker with network access to the affected CSM services can potentially gain elevated privileges. The CVSS score is 10.0 (critical). The exact affected component is not named in Dell's advisory; secondary sources point to the CSM Authorization proxy and tenant service, which manage access to storage arrays on Kubernetes or OpenShift.
Affected
- Dell Container Storage Modules versions prior to 1.18.0
- Relevant mainly where CSM Authorization or CSM CSI drivers run on Kubernetes or OpenShift with Dell PowerStore, PowerScale, PowerFlex, PowerMax or Unity XT storage
Fixed in
- Upgrade to Dell Container Storage Modules 1.18.0 or later (per Dell advisory DSA-2026-448)
Workaround
- No vendor workaround. Dell lists no workarounds; upgrading is the only fix.
- After upgrading, rotate the JWT signing secret used by CSM Authorization.
- If the services were reachable from untrusted networks, rotate the storage array administrator credentials registered with CSM Authorization.
- Review access to the CSM Authorization gRPC server, Authorization proxy and tenant service and restrict unintended exposure.
Exploitation
- Dell does not report exploitation.
- No known exploitation at the time of writing (secondary sources).
- VulDB reports that neither technical details nor an exploit are publicly available.
- CISA KEV status and public proof-of-concept code were not verified.
Our recommendation
- Check whether Dell Container Storage Modules or CSM Authorization is in use and identify the installed version.
- Upgrade affected installations to version 1.18.0 or later as a priority.
- After patching, rotate JWT signing secrets and storage array administrator credentials if the services were exposed.
- Restrict network access to CSM services to required systems only.
- Monitor CISA KEV and vendor channels for exploitation indicators.
- Organisations without Dell CSM are not affected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell DSA-2026-448 security update www.dell.com
- University of Toronto security advisory security.utoronto.ca
- FieldEffect analysis fieldeffect.com
- VulDB entry 414305 vuldb.com
- NVD mirror (Vulners) vulners.com
- AHA vulnerability bulletin www.aha.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:37.
Original description (NVD)
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.