Dell has fixed six maximum-severity vulnerabilities in Container Storage Modules, the software that connects its enterprise storage arrays to Kubernetes clusters, BleepingComputer reported Friday. The flaws could let attackers take administrative control of the storage authorization service, steal array credentials or gain root access on cluster nodes, and Dell is urging customers to upgrade to version 1.18.0 or later.

What Happened

Container Storage Modules, or CSM, add features such as authorization, replication and observability on top of Dell's Kubernetes storage drivers. The suite supports Dell's main storage lines: PowerStore, PowerScale, PowerFlex, PowerMax and Unity XT.

Dell's advisories describe a common root cause across all six bugs: critical functions that do not require authentication. The most serious individual issues are:

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says
  • CVE-2026-63688, in the CSM Authorization module, which lets an unauthenticated remote attacker obtain storage administrator credentials for every registered array and bypass authorization to gain full administrative control.
  • CVE-2026-63692, in the authorization proxy and tenant service, which allows an authentication bypass to administrator privileges. Dell called it critical because an unauthenticated attacker could take complete control of the authorization service and potentially reach storage resources across all tenants.
  • CVE-2026-67269, which can give a remote attacker root access on cluster nodes.
  • CVE-2026-54472, which grants administrative access to the CSM Authorization proxy.
  • CVE-2026-61421, which lets an attacker forge authentication tokens to obtain administrative privileges.
  • CVE-2026-67273, which bypasses Kubernetes access controls and exposes cluster-wide Secrets.

Dell said it recommends customers upgrade "at the earliest opportunity." BleepingComputer said no active exploitation had been reported at publication.

Why It Matters

CSM Authorization is designed to be a security boundary. It lets storage administrators hand out limited capacity to Kubernetes tenants without giving them the array's own credentials. Flaws that expose those credentials or let an outsider become administrator of the proxy defeat that purpose. An attacker who holds array admin rights can read, alter or delete volumes used by every application on the platform, not just one workload.

The Secrets exposure in CVE-2026-67273 widens the risk beyond storage. Kubernetes Secrets commonly hold database passwords, API keys and cloud credentials, so cluster-wide read access could hand an intruder the keys to systems far from the storage layer. Root on a node, through CVE-2026-67269, gives a foothold to move between containers.

Because the bugs require no authentication in several cases, any instance of the authorization service reachable from an untrusted network should be treated as exposed until patched.

Context

Dell products have been targeted by capable attackers before. BleepingComputer noted that North Korea's Lazarus group used a Dell driver flaw, CVE-2021-21551, to deploy a Windows rootkit, and that a China-linked group tracked as UNC6201 exploited hardcoded credentials in Dell RecoverPoint, CVE-2026-22769, starting in mid-2024. After that RecoverPoint activity came to light in February, CISA ordered federal agencies to patch within three days.

Storage and backup systems have become attractive targets because they hold concentrated copies of data and often sit outside the endpoint monitoring that covers servers and laptops.

What to Watch

Watch for public proof-of-concept code, which tends to follow detailed advisories for authentication bypasses, and for any addition of these CVEs to CISA's Known Exploited Vulnerabilities catalog. Administrators who cannot upgrade immediately should check whether the CSM Authorization proxy is reachable from outside trusted networks and rotate array and Kubernetes credentials after patching, since past exposure cannot be ruled out from the advisories alone.