Dell Container Storage Modules: Privilege escalation in CSM Operator reconciler
Summary
Dell Container Storage Modules (CSM) Operator prior to version 1.18.0 contains an improper privilege management flaw in the ContainerStorageModule custom resource reconciler. A low-privileged remote attacker with network access can exploit it without user interaction to escalate privileges and obtain root-level access on cluster nodes. CSM connects Dell storage arrays to Kubernetes clusters, so the impact is high in shared or multi-tenant clusters.
Affected
- Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0
- Note: one third-party source states the lower bound is 1.17.0; Dell's advisory states 1.18.0, which is used here.
Fixed in
- Upgrade to Dell Container Storage Modules 1.18.0 or later (per Dell DSA-2026-448).
Workaround
- Unknown. Dell lists no workaround; upgrading is the only fix.
- Interim hardening only (not a fix): review Kubernetes RBAC and restrict access to CSM components.
Exploitation
- CISA KEV: not listed.
- No known in-the-wild exploitation found for this CVE.
- No public proof-of-concept found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Identify any CSM deployments and their versions in your Kubernetes or OpenShift clusters.
- Upgrade to CSM 1.18.0 or later; this also fixes the other critical issues in DSA-2026-448.
- After the upgrade, rotate secrets as advised by Dell and the University of Toronto.
- Verify that only trusted accounts can create or modify ContainerStorageModule custom resources.
- Treat this as high priority if CSM is in use; most SMEs will not run it.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell DSA-2026-448 www.dell.com
- NVD/CVE data via Vulners vulners.com
- OSV osv.dev
- University of Toronto advisory security.utoronto.ca
- Health-ISAC bulletin www.aha.org
- Field Effect fieldeffect.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:37.
Original description (NVD)
Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could potentially exploit this vulnerability, leading to escalation of privileges and gaining root-level access on cluster nodes.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.