Cluster-Wide Storage Takeover: Dual CVSS 10.0 Vulnerabilities in Dell Container Storage Modules Expose Enterprise Kubernetes Deployments
Published on DigitalSpying.com | October 2, 2026
Author: DigitalSpying Threat Research Team
Threat Classification: Maximum Severity (CVSS v3.1: 10.0) | Critical Enterprise Infrastructure
Executive Summary
Cloud-native storage fabrics represent the foundational backbone of modern Kubernetes deployments, orchestrating persistent data volumes across mission-critical enterprise applications. On October 2, 2026, Dell Technologies issued an urgent security bulletin (DSA-2026-448), reported across BleepingComputer and The Hacker News, detailing a cluster of critical vulnerabilities in Dell Container Storage Modules (CSM).
Most critically, the update addresses two separate maximum-severity vulnerabilities rated CVSS 10.0/10.0—tracked as CVE-2026-63691 and CVE-2026-63692. These flaws allow unauthenticated remote attackers across the network to completely bypass authentication controls, achieve administrative dominance over the CSM authorization proxy and tenant services, and manipulate or exfiltrate persistent storage volumes across all enterprise tenants. Accompanying these twin 10.0 bugs are four additional critical vulnerabilities that allow remote root access on Kubernetes cluster nodes (CVE-2026-67269) and unauthorized cluster-wide harvesting of Kubernetes Secrets (CVE-2026-67273). Dell is urging enterprise administrators to upgrade to CSM version 1.18.0 immediately.
Vulnerability Overview
Vulnerability ID
Severity
CVSS Score
Component
Primary Impact
CVE-2026-63691
Critical
10.0
CSM Authorization Proxy
Unauthenticated API Auth Bypass & Administrative Takeover
CVE-2026-63692
Critical
10.0
Tenant Management Service
Multi-Tenant Isolation Collapse & Arbitrary Volume Binding
CVE-2026-67269
Critical
9.8
CSM Node Daemon
Unprivileged Remote Code Execution to Node root
CVE-2026-67273
Critical
8.8
Service Account Subsystem
Cluster-wide Kubernetes Secrets Harvesting (RBAC Bypass)
CVE-2026-61421
High
7.5
Crypto Token Generator
Arbitrary Token Minting
CVE-2026-54472
High
7.5
Token Validation Engine
Administrative Impersonation
Technical Deep-Dive: Deconstructing the CSM Architecture & Exploit Primitives
1. The Role of Dell Container Storage Modules (CSM)
In enterprise container ecosystems, Dell CSM extends standard Kubernetes Container Storage Interface (CSI) drivers. It connects containerized workloads running on Red Hat OpenShift, Amazon EKS, and upstream Kubernetes to Dell's high-performance enterprise storage arrays—including PowerMax, PowerStore, PowerFlex, and Dell Unity.
CSM provides multi-tenancy isolation, volume replication, authorization proxying, and automated encryption. Consequently, the CSM authorization proxy acts as the centralized gatekeeper determining which tenant pods can mount, read, write, or snapshot persistent storage volumes.[Unauthenticated Remote Attacker]
│
│ 1. Sends malformed API handshake to CSM Authorization Proxy
▼
[Dell CSM Authorization Proxy / Tenant Service (Port 443)]
│
│ 2. Authentication Bypass (CVE-2026-63691 / CVE-2026-63692)
▼
[Administrative Control Over Storage Gateway (CVSS 10.0)]
│
├─────────────────────────────────┬─────────────────────────────────┐
▼ ▼ ▼
[Tenant A Storage Volumes] [Tenant B Storage Volumes] [Cluster Node Root (CVE-2026-67269)]
(PowerMax / PowerStore) (PowerFlex / Unity) (Kubernetes Secrets Hijack CVE-2026-67273)
2. The Twin CVSS 10.0 Flaws: CVE-2026-63691 & CVE-2026-63692
Both vulnerabilities reside in the communication pipeline between the CSM Authorization proxy and its backend tenant-management microservices:
* CVE-2026-63691 (Improper Authentication in Authorization Proxy): The proxy fails to validate internal token signatures when external API requests interact with administrative endpoints. An unauthenticated attacker transmitting a crafted request directly to the proxy port can forge valid administrative session contexts, granting unrestricted command execution over storage provisioning APIs.
* CVE-2026-63692 (Authentication Bypass in Tenant Management Service): A complementary authentication bypass flaw in the tenant-isolation subsystem allows external actors to impersonate legitimate storage administrators. This flaw enables attackers to arbitrarily modify tenant boundaries, bind unauthorized persistent volume claims (PVCs) to attacker-controlled workloads, and mount external volumes containing unencrypted financial and customer databases.
3. The Companion Attack Chain: Node Root & Secret Harvesting
The security advisory also eliminates four critical vulnerabilities that elevate the blast radius from storage tampering to full container cluster compromise:
* CVE-2026-67269 (Remote Root on Cluster Nodes): An unprivileged network attacker can exploit command execution weaknesses within the CSM node daemon to gain full root privileges on underlying Kubernetes worker nodes.
* CVE-2026-67273 (Kubernetes Secrets Clearance Bypass): Flaws in CSM's service-account permissions enable an attacker to bypass Kubernetes Role-Based Access Controls (RBAC), obtaining cluster-wide read access to Kubernetes Secrets—exposing database passwords, TLS private certificates, and cloud API keys.
* CVE-2026-61421 & CVE-2026-54472: Weaknesses in cryptographic token generation permitting arbitrary token minting and administrative impersonation.
Industry & Enterprise Threat Landscape
The emergence of CVSS 10.0 flaws in enterprise storage orchestrators represents an urgent threat vector:
* Catastrophic Ransomware & Extortion Leverage: Rather than deploying noisy ransomware payloads inside individual container pods, threat actors compromising the storage management plane can delete, unmap, or encrypt entire storage pools across hundreds of virtual machines and container clusters simultaneously at the SAN/NAS array level.
* Cross-Tenant Data Spills in Cloud Environments: Organizations utilizing Dell CSM to enforce multi-tenancy in shared private cloud or Kubernetes environments face complete collapse of data separation boundaries.
* Nation-State Infrastructure Precedent: While Dell has not identified active in-the-wild exploitation at the time of disclosure, enterprise storage and virtualization platforms have been primary targets for advanced persistent threats. As documented by Mandiant and Google Threat Intelligence Group (GTIG), Chinese state-nexus groups (UNC6201 / Silk Typhoon) and North Korean units (Lazarus) have repeatedly exploited hardcoded credentials and authentication flaws in Dell infrastructure (such as RecoverPoint and dbutil) to entrench themselves in virtualized datacenter environments.
Mitigation & Hardening Roadmap
Because of the maximum severity rating and unauthenticated attack vectors, DevOps and storage engineering teams must execute the following remediation measures immediately:
1. Upgrade Dell Container Storage Modules
Upgrade all deployed CSM modules to version 1.18.0 or later:
* Follow the official Dell CSM Operator update workflow via Helm or OpenShift OperatorHub.
* Verify that both the control-plane authorization proxies and all node-level daemonsets are updated to the fixed release.
2. Isolate CSM Management & Proxy Interfaces
* Network Segmentation: Never expose the CSM Authorization proxy or tenant service management ports directly to untrusted or external networks. Restrict proxy access strictly to authorized Kubernetes control plane nodes via NetworkPolicies and perimeter firewalls.
* Mutual TLS (mTLS): Enforce strict mTLS authentication between the Kubernetes CSI driver sidecars and the CSM authorization proxy.
3. Audit Kubernetes Secrets & Storage Volume Mappings
* Review Kubernetes audit logs for unusual calls to the CSM authorization proxy, specifically requests requesting tenant quota alterations or token issuance.
* Inspect cluster-wide RBAC bindings associated with the CSM service account to verify least-privilege principles.
* Invalidate and rotate any Kubernetes secrets or storage array API tokens that may have been accessible to the CSM service daemon prior to upgrading.
References & Official Sources
* BleepingComputer: Dell Asks Admins to Patch Max Severity CSM Flaws As Soon As Possible
* The Hacker News: Dell CSM Flaws Enable Unauthenticated Admin Access and Root
* Dell Security Advisory DSA-2026-448: Dell Container Storage Modules Vulnerabilities
* NVD NIST Database: CVE-2026-63691 & CVE-2026-63692 Detail