# Dell Container Storage Modules (CSM) flaws enable unauthenticated admin access and root on Kubernetes nodes (CVE-2026-63688, CVE-2026-63692, CVE-2026-67269, CVE-2026-54472, CVE-2026-61421, CVE-2026-67273)

> Dell advisory DSA-2026-448 (2026-10-01) fixes six critical flaws (CVSS 9.6-10.0) in Dell Container Storage Modules: missing authentication in the csm-authorization-storage gRPC server and the authorization proxy/tenant service, hard-coded credentials and a hard-coded JWT signing key enabling forged admin tokens, improper privilege management in the CSM Operator custom resource reconciler giving root on cluster nodes, and a template engine injection enabling cluster-wide Secret reads and RBAC tampering. Fixed in CSM 1.18.0; no in-the-wild exploitation or public PoC was reported at publication.

- **Published:** 2026-10-02T00:00:00Z
- **Last reviewed:** 2026-10-03T13:21:15.309Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2851
- **ID:** TL-2026-2851
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-63688, CVE-2026-63692, CVE-2026-67269, CVE-2026-54472, CVE-2026-61421, CVE-2026-67273, CVE-2026-67270, CVE-2026-76105, CVE-2026-61411, CVE-2026-70411, CVE-2026-63689, CVE-2026-63691, CVE-2026-63690, CVE-2026-40710

## Description

Dell Container Storage Modules (CSM) is the software layer that connects Dell storage arrays (PowerStore, PowerScale, PowerFlex, PowerMax and Unity XT) to Kubernetes clusters. On 2026-10-01 Dell published DSA-2026-448 covering six vulnerabilities, reported on 2026-10-02 by The Hacker News and several secondary outlets.

CVE-2026-63688 (CVSS 10.0) is a missing-authentication flaw in the csm-authorization-storage gRPC server. An unauthenticated remote attacker who can reach the service can obtain storage-backend administrator credentials for all registered storage arrays, which bypasses the csm-authorization security model and gives full administrative control across all five supported Dell storage families. One secondary source maps it to CWE-863. CVE-2026-63692 (CVSS 10.0) is a missing-authentication flaw in the authorization proxy and tenant service. An unauthenticated network attacker can bypass login checks and gain administrative privileges, including reading and altering storage resources across all tenants.

CVE-2026-54472 (CVSS 9.8) is a hard-coded-credentials flaw in the CSM authorization proxy that lets a remote attacker forge cryptographically valid administrative tokens. CVE-2026-61421 (CVSS 9.8) is a hard-coded cryptographic key in the archived karavi-authorization project: a sample JWT signing secret published in the setup documentation lets an unauthenticated attacker forge authentication tokens against deployments that kept the sample value. Mitigation therefore includes rotating JWT signing secrets and retiring karavi-authorization deployments.

CVE-2026-67269 (CVSS 9.9) is an improper-privilege-management flaw in the ContainerStorageModule custom resource reconciler of the CSM Operator. A low-privileged user who can submit a single custom resource can obtain root-level access on cluster nodes, and so potentially compromise every node in the Kubernetes cluster. CVE-2026-67273 (CVSS 9.6) is a template engine injection flaw that lets a low-privileged remote attacker escalate privileges, tamper with RBAC and read Kubernetes Secrets cluster-wide.

Affected: CSM prior to 1.17.0 per Dell-derived reporting (one outlet says 'before 1.18.0'; the boundary is inconsistent across sources). Fixed in CSM 1.18.0 (components cited: CSM Authorization 2.4.0, CSM Operator 1.12.0); the release also updates the third-party dependencies golang.org/x/crypto, golang.org/x/net, golang-jwt and protobuf. No workarounds are listed beyond patching. Secondary reporting advises restricting network access to CSM services to cluster-internal sources, rotating storage administrator credentials and JWT signing secrets, auditing Secret access logs, admin sessions and RBAC role changes, and retiring karavi-authorization. No in-the-wild exploitation or public proof of concept was reported at publication, though one outlet warns that CVSS 10 flaws like these are quickly reverse-engineered from patches. A related earlier advisory, DSA-2026-234 (2026-05-21, CVE-2026-40710, CVSS 10.0, hard-coded default credentials in CSM Operator 1.6.0-1.16.3 and Helm Charts 1.11.0-1.16.3, fixed in 1.17.0), shows the same product line has a recent history of hard-coded credential exposure.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078.001 Valid Accounts: Default Accounts
- T1552 Unsecured Credentials
- T1552.007 Unsecured Credentials: Container API
- T1606 Forge Web Credentials
- T1548 Abuse Elevation Control Mechanism
- T1098 Account Manipulation
- T1611 Escape to Host
- T1550 Use Alternate Authentication Material
- T1078 Valid Accounts
- T1212 Exploitation for Credential Access
- T1552.001 Unsecured Credentials: Credentials In Files
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1098.006 Account Manipulation: Additional Container Cluster Roles
- T1068 Exploitation for Privilege Escalation

## Sources

- [Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes](https://thehackernews.com/2026/10/dell-csm-flaws-enable-unauthenticated.html)
- [Dell CSM: two CVSS 10 auth-bypass flaws, patch to 1.18.0](https://www.hackerposts.org/en/blog/dell-csm-dsa-2026-448-max-severity-auth-bypass)
- [Dell Patches Two CVSS 10 Flaws in Container Storage Modules](https://securityonline.info/dell-container-storage-modules-vulnerabilities/)
- [Dell Patches Two CVSS 10 Container Storage Modules Flaws](https://sqmagazine.co.uk/dell-patches-cvss-10-flaws-container-storage-modules/)
- [Dell CSM: Zwei CVSS-10-Lücken im Authorization-Modul](https://s-edv.com/news/dell-csm-authorization-cvss-10-luecken)
- [DSA-2026-234: Security Update for Dell Container Storage Modules Hard-coded Credentials Vulnerability (CVE-2026-40710)](https://www.dell.com/support/kbdoc/en-ca/000467149/dsa-2026-234-security-update-for-dell-container-storage-modules-hard-coded-credentials-vulnerability)
- [dell/karavi-authorization (CSM Authorization v1, deprecated)](https://github.com/dell/karavi-authorization)
- [Dell Container Storage Modules documentation](https://www.dell.com/support/product-details/en-mr/product/container-storage-modules/resources/manuals)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2851