Dell is warning customers to upgrade affected systems to address a pair of maximum-severity vulnerabilities that could hand attackers administrative control over enterprise storage environments.
The two vulnerabilities, tracked as CVE-2026-63688 and CVE-2026-63692, each carry a CVSS score of 10.0 and affect Dell Container Storage Modules (CSMs), which extend Dell enterprise storage capabilities into Kubernetes environments. Both can potentially be exploited remotely without authentication, according to Dell's Oct. 1 security advisory.
The consequences could reach well beyond a compromised application. One flaw could expose administrator credentials for every registered storage array, while the other could give an attacker administrative control over the CSM authorization service and access to storage resources across tenants.
Two Dell vulnerabilities receive perfect 10.0 severity scores
CVE-2026-63688 is a missing-authentication vulnerability in the CSM Authorization storage gRPC server.
Dell says an unauthenticated remote attacker could exploit the flaw to obtain storage backend administrator credentials for all registered storage arrays. The company also pointed out that successful exploitation could bypass the CSM Authorization security model entirely, granting an attacker full administrative control over the connected storage infrastructure.
CVE-2026-63692 presents a similarly serious threat.
The vulnerability affects the authorization proxy and tenant service in CSM Authorization 2.4.0. An unauthenticated network attacker could potentially bypass authentication and elevate privileges to the administrative level. That access could allow an attacker to manipulate storage resources across tenants.
Both vulnerabilities have network-accessible attack vectors, require no privileges or user interaction, and received the maximum possible CVSS score. Dell's Container Storage Modules are designed to extend enterprise storage capabilities into Kubernetes, providing integration and automation for cloud-native stateful applications.
Dell advisory includes more critical Kubernetes vulnerabilities
The two 10.0 vulnerabilities aren't the only serious security problems Dell has addressed.
CVE-2026-67269, rated 9.9, affects the CSM Operator. A low-privilege remote attacker could potentially escalate privileges and obtain root-level access on Kubernetes cluster nodes.
Dell warns that successful exploitation could compromise all nodes in a Kubernetes cluster through a single custom resource submission.
Another vulnerability, CVE-2026-54472, carries a 9.8 rating and involves hard-coded credentials in CSM Authorization. An unauthenticated remote attacker could potentially forge valid administrative tokens, bypass authentication, and manage storage access policies across connected tenants.
Dell specifically tells organizations addressing this vulnerability to immediately rotate JWT signing secrets.
A separate 9.8 vulnerability, CVE-2026-61421, concerns the now-archived karavi-authorization component. Dell says organizations that followed older documentation that contained a publicly available JWT signing secret and never rotated it may remain vulnerable.
The advisory also includes CVE-2026-67273, rated 9.6, which could give a low-privilege attacker cluster-wide read access to Kubernetes Secrets and the ability to create cluster-scoped role-based access control resources.
The collection illustrates how weaknesses in authentication and privilege controls can lead to broader exposure of the infrastructure. eSecurity Planet has previously examined why Kubernetes security requires controls across workloads, clusters, identities, and configurations, particularly when sensitive enterprise resources are connected to containerized environments.
Dell provides remediation, but no workaround
Dell lists Container Storage Modules versions prior to 1.17.0 as affected and version 1.18.0 or later in its remediation table. However, Dell cautions that the table may not include all affected supported versions and may be updated as more information becomes available.
The advisory also separately identifies CVE-2026-76105, a 7.7-rated vulnerability involving insufficiently random values, as affecting CSM version 1.18.0. Organizations should therefore review Dell's advisory against the specific CSM components and versions in their environments, rather than assuming a deployment is unaffected solely based on the top-level version number.
Dell lists no workarounds or mitigations for the vulnerabilities and recommends customers upgrade at the earliest opportunity.
For CVE-2026-54472, administrators should also follow Dell's recommendation to immediately rotate JWT signing secrets rather than treating the software update alone as the entire response.
What security teams should do now
For security and infrastructure teams using Dell storage with Kubernetes, these vulnerabilities deserve attention beyond a routine patch cycle.
The potential attack paths span several layers of infrastructure: Kubernetes, authentication services, tenant boundaries, administrative credentials, and storage systems that hold organizational data. Compromise at that intersection could give an attacker considerably more leverage than a vulnerability isolated to a single application.
Security teams should start by identifying whether Dell Container Storage Modules are deployed at all, particularly in environments where Kubernetes and storage responsibilities are split between different teams. An inventory gap could leave vulnerable CSM components outside the normal vulnerability-management workflow.
From there, defenders should:
- Review Dell's advisory and update affected components. Match the specific CSM components and versions in the environment against Dell's latest remediation guidance rather than relying solely on the top-level CSM version.
- Rotate JWT signing secrets where applicable. Dell explicitly recommends immediate rotation for CVE-2026-54472.
- Review access to storage administrator credentials. Because CVE-2026-63688 can expose backend administrator credentials, teams should assess whether credential rotation is appropriate based on their exposure and investigation findings.
- Audit Kubernetes privileges. Pay particular attention to accounts that can submit or modify custom resources, as CVE-2026-67269 could allow a low-privilege attacker to escalate to root access across cluster nodes.
- Inspect Kubernetes RBAC and Secrets access. CVE-2026-67273 could enable cluster-wide access to Secrets and unauthorized creation of cluster-scoped RBAC resources.
- Look for suspicious administrative activity. Review authentication events, privilege changes, storage configuration changes, token use, and unusual access to storage resources.
- Check older deployments. Organizations that previously used the archived karavi-authorization component should determine whether they followed the affected configuration guidance and whether the exposed signing secret was ever rotated.
The broader lesson is that container security doesn't stop at the cluster boundary. Kubernetes increasingly sits between applications and critical infrastructure, such as storage, identity systems, and cloud services, so weaknesses in integration layers can become pathways into systems that hold an organization's most valuable data.
That's why controls such as Kubernetes network segmentation and strong privileged access management matter alongside patching. If a vulnerable integration component can reach storage with administrative privileges, limiting what identities, workloads, and network paths can reach that component can reduce the blast radius of a compromise.
For organizations using Dell CSM, the immediate question is straightforward: Are any of the vulnerable components running in the environment? With two vulnerabilities scoring 10.0, no workaround available, and multiple additional flaws that can compromise Kubernetes privileges, security teams should compare their deployments against Dell's latest advisory and remediate affected components as quickly as possible.
Also read: Docker Flaw Lets Attackers Bypass Security Controls and Take Over Hosts to learn how another critical container weakness can put underlying infrastructure at risk.