Dell Container Storage Modules face critical Kubernetes vulnerabilities

Multiple critical vulnerabilities have been identified in Dell Container Storage Modules (CSM), affecting versions prior to 1.18.0. These flaws impact the integration of Dell storage systems within Kubernetes clusters and containerized environments.

One of the most severe vulnerabilities, CVE-2026-63688, carries a CVSS score of 10.0. It allows unauthenticated remote attackers to achieve remote code execution via crafted gRPC calls to the csm-authorization-storage service. Other significant flaws include improper authorization logic, insufficient input validation, and a race condition during volume snapshot creation.

Exploitation of these vulnerabilities could allow adversaries to gain full administrative control over Kubernetes storage planes. This includes the ability to create, modify, or delete persistent volumes, access sensitive snapshots, and potentially escalate privileges to root-level access on cluster nodes. The flaws also present risks of data exfiltration, storage class injection, and the deployment of ransomware across an estimated 2,000 exposed clusters globally.