Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes

Dell has shipped security updates fixing six critical vulnerabilities in its Container Storage Modules (CSM) that could let attackers seize full control of storage infrastructure and Kubernetes clusters without any credentials. Two flaws, CVE-2026-63688 and CVE-2026-63692, score a perfect 10.0 CVSS and stem from missing authentication in the csm-authorization gRPC server and the authorization proxy/tenant service, letting remote attackers grab backend admin credentials or bypass login entirely to gain admin rights across all tenants. Other bugs include CVE-2026-67269 (9.9), which lets a low-privileged user escalate to root on every node in a cluster via a single malicious custom resource; CVE-2026-54472 (9.8) and CVE-2026-61421 (9.8), both tied to hard-coded credentials or signing keys that allow forging valid admin tokens; and CVE-2026-67273 (9.6), a template-injection issue enabling privilege escalation and RBAC tampering. All versions of CSM prior to 1.17.0 are affected, with fixes available in 1.18.0 — there is no workaround, so Dell urges customers to update immediately and rotate any JWT signing secrets, especially given that past Dell product flaws have previously been exploited in the wild.