Dell has patched a collection of critical vulnerabilities in its Container Storage Modules that could allow attackers to bypass authentication, steal storage administrator credentials and, in some cases, gain root access across Kubernetes nodes.
The six vulnerabilities affect Dell Container Storage Modules (CSM), software used to integrate Dell storage platforms with Kubernetes environments. All CSM releases prior to version 1.17.0 are affected, with fixes delivered in version 1.18.0. Several flaws carry CVSS scores of 9.8 or higher, including two rated the maximum 10.0.
From No Authentication to Storage Administrator
Two of the vulnerabilities are particularly severe because attackers do not need existing credentials.
CVE-2026-63688, rated CVSS 10.0, affects thecsm-authorization-storagegRPC server. An unauthenticated remote attacker could exploit missing authentication controls to obtain administrator credentials for every storage array registered with the service.
Dell warned that successful exploitation could effectively bypass the CSM authorization model and provide administrative control across all five supported Dell storage product families.
A second maximum-severity vulnerability,CVE-2026-63692, affects the authorization proxy and tenant service. It can allow an unauthenticated network attacker to bypass authentication entirely and obtain administrative privileges, potentially exposing storage resources belonging to multiple tenants.
Kubernetes Turns the Impact Into a Cluster Problem
The vulnerabilities become even more serious because CSM operates inside Kubernetes infrastructure, where a compromise can extend beyond storage.
CVE-2026-67269, rated 9.9, affects the ContainerStorageModule Custom Resource reconciler. A low-privileged attacker able to submit a specially crafted custom resource could escalate privileges and ultimately gain root access on Kubernetes nodes.
Dell says exploitation could compromise every node in a cluster through a single custom resource submission.
Another vulnerability,CVE-2026-67273, could allow a low-privileged attacker to manipulate templates and gain cluster-wide read access to Kubernetes Secrets. It could also enable the creation of cluster-scoped RBAC resources, effectively bypassing the access controls intended to separate workloads and privileges.
This is where a storage vulnerability becomes a broader cloud security problem. Kubernetes Secrets can contain database passwords, API credentials, certificates and other authentication material, giving attackers potential paths into additional services.
Hard-Coded Secrets Create Another Route In
Two additional vulnerabilities involve credentials embedded in CSM components.
CVE-2026-54472 involves hard-coded credentials that could allow an unauthenticated attacker to generate cryptographically valid administrative tokens for the CSM Authorization proxy.CVE-2026-61421, meanwhile, involves a hard-coded cryptographic key used by the JWT authentication component inkaravi-authorization.
Knowledge of the publicly available signing secret could allow an attacker to forge authentication tokens and obtain administrative privileges. Dell is therefore advising organizations not only to install the security update but also to rotate JWT signing secrets following remediation.
There Is No Workaround
Dell says there are no alternative mitigations or workarounds for the vulnerabilities. Customers need to move to the corrected release, making the update particularly important for organizations running CSM in production Kubernetes environments.
There is currently no indication in the disclosure that these specific vulnerabilities are being actively exploited. Still, their combination creates an unusually dangerous attack surface: authentication bypass, credential theft, forged tokens, Kubernetes Secrets exposure and root-level node access all sit within the same product family.
The vulnerabilities also illustrate why infrastructure components connecting Kubernetes to external systems deserve the same scrutiny as the cluster itself. Storage integrations are not simply plumbing. They often sit between Kubernetes identities, privileged credentials and the systems holding an organization’s most valuable data.
When that layer fails,a vulnerability in storage management can quickly become a compromise of the entire Kubernetes trust boundary.