Dell Dell Container Storage Modules (CSM) vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Dell Dell Container Storage Modules (CSM): 4 record(s), with affected versions and fixes.
CVE-2026-70411
High · 7.1
CWE-306 Oct 6, 2026
Missing Authentication for Critical Function in Dell Dell Container Storage Modules (CSM)
Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service (TenantService). An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized creation of tenant entities, cross-tenant role injection, and modification of storage access control flags.
CVE-2026-67270
High · 8.2
CWE-295 Oct 6, 2026
Improper Certificate Validation in Dell Dell Container Storage Modules (CSM)
Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to information exposure of storage backend administrator credentials.
CVE-2026-67269
Critical · 9.9
CWE-269 Oct 6, 2026
Improper Privilege Management in Dell Container Storage Modules
Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could potentially exploit this vulnerability, leading to escalation of privileges and gaining root-level access on cluster nodes.
CVE-2026-63688
Critical · 10.0
CWE-306 Oct 6, 2026
Missing Authentication for Critical Function in Dell Container Storage Modules
Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to storage backend administrator credentials for all registered storage arrays.