Dell patches max-severity flaws in Kubernetes storage modules

Dell has released fixes for two maximum-severity vulnerabilities in Container Storage Modules (CSM), the components that connect the company's enterprise storage arrays to Kubernetes environments. CSM supports Dell's primary storage platforms (PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT) and extends the capabilities of the standard Container Storage Interface (CSI) drivers.

In a security advisory published Thursday, Dell said both critical flaws were found in the CSM Authorization security module and stem from missing authentication for critical functions.

Full administrative control without authentication

The first flaw (CVE-2026-63688) lets an unauthenticated remote attacker obtain the backend administrator credentials for every registered storage array and bypass authorization to gain full administrative control over the storage infrastructure.

The second flaw (CVE-2026-63692) affects the authorization proxy and tenant service and likewise lets an attacker gain admin privileges by bypassing authentication. According to Dell, this gives an intruder the ability to access and manipulate storage resources across all tenants.

The same day, the company patched four more critical CSM issues. Exploitation allows remote, unprivileged attackers to gain root on cluster nodes (CVE-2026-67269), obtain administrative access to the CSM Authorization proxy (CVE-2026-54472), forge authentication tokens for admin privileges (CVE-2026-61421), and bypass Kubernetes access controls to read Kubernetes Secrets cluster-wide (CVE-2026-67273).

Dell urges customers to upgrade Container Storage Modules to version 1.18.0 or later, which addresses all of these flaws, at the earliest opportunity.

The risks aren't hypothetical

Dell has not flagged these particular bugs as exploited in the wild, but other flaws in its products have been abused in past years. North Korea's Lazarus group, for instance, deployed a Windows rootkit by exploiting a flaw in the Dell dbutil driver (CVE-2021-21551).

In February, Mandiant and the Google Threat Intelligence Group reported that a suspected Chinese group, UNC6201, had been exploiting a hardcoded-credential flaw (CVE-2026-22769) in Dell RecoverPoint for Virtual Machines since at least mid-2024, deploying malware and creating hidden network interfaces on VMware ESXi servers. Days later, the U.S. cybersecurity agency CISA ordered government agencies to patch vulnerable Dell systems within three days.

Source: Bleeping Computer