Security advisory: Critical vulnerabilities in Dell Container Storage Modules (CSM)
Published: October 5, 2026
Dell DSA-2026-448 | CVE-2026-63688, CVE-2026-63692 and others
Severity: Critical (CVSS up to 10.0)
Status: Patch available. No known exploitation at the time of writing. Upgrade promptly.
Topics on this page:
Summary
Dell has fixed multiple critical vulnerabilities in Container Storage Modules (CSM), the software that connects Dell storage arrays (PowerStore, PowerScale, PowerFlex, PowerMax and Unity XT) to Kubernetes clusters. The two most serious flaws, both rated 10.0, are in the CSM Authorization module and let an attacker with network access and no credentials obtain storage administrator credentials for every registered array or take full administrative control of the authorization service. Other critical flaws in the same release allow root access on cluster nodes and cluster-wide access to Kubernetes Secrets. Dell lists no workarounds; upgrading is the only fix.
Vulnerability details
| CVE | CVSS | Component | Impact |
|---|---|---|---|
| CVE-2026-63688 | 10.0 | CSM Authorization | An unauthenticated attacker obtains storage administrator credentials for all registered arrays. |
| CVE-2026-63692 | 10.0 | CSM Authorization | An unauthenticated attacker gains administrative control of the authorization service across all tenants. |
| CVE-2026-67269 | 9.9 | CSM Operator | Low-privileged Kubernetes user gains root on all cluster nodes. |
| CVE-2026-54472 | 9.8 | CSM Authorization | Hard-coded credentials allow forged administrative tokens. |
| CVE-2026-61421 | 9.8 | karavi-authorization (archived) | Publicly documented default JWT secret allows forged administrative tokens. |
| CVE-2026-67273 | 9.6 | CSM | Low-privileged user gains cluster-wide read access to Kubernetes Secrets and can create RBAC resources. |
The same release also fixes seven lower-severity CSM issues (CVSS 5.4–8.2) and several third-party Go library vulnerabilities.
Impacted versions
- Dell Container Storage Modules versions before 1.18.0. Fixed in 1.18.0 and later.
- Any remaining deployment of the archived karavi-authorization component, which will not be fixed and should be removed.
Recommendations
- Upgrade Dell Container Storage Modules to version 1.18.0 or later.
- After upgrading, rotate the JWT signing secret used by CSM Authorization, as Dell advises for CVE-2026-54472. Any deployment that used the documented default secret (“supersecret”) must rotate it regardless of version.
- Rotate the storage array administrator credentials registered with CSM Authorization if the service was reachable from untrusted networks.
- Until patched, restrict network access to the CSM Authorization proxy and services to trusted hosts only.
Support
As always, please let us know if you have any questions or concerns or see unusual activity on your systems that you believe might be associated with this or any other vulnerability. Please send these communications to security.response@utoronto.ca.
