Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes
Summary: Dell released security updates for multiple critical flaws in its Container Storage Modules (CSM) affecting all versions prior to 1.17.0, fixed in 1.18.0. Dell said CVE-2026-63688 allows a complete bypass of the csm-authorization security model and full administrative control over storage infrastructure across all five supported Dell storage product families, while CVE-2026-67269 lets an attacker compromise all nodes in a Kubernetes cluster through a single custom resource submission.
Key Takeaway: Dell states there are no workarounds or mitigations other than updating to 1.18.0 and rotating JWT signing secrets, and notes that prior Dell vulnerabilities CVE-2021-21551 and CVE-2026-22769 came under active exploitation in recent years.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-21551CVE-2026-22769CVE-2026-54472CVE-2026-63688CVE-2026-63692CVE-2026-67269CVE-2026-67273
- Related
- CVE-2026-22769: Dell Recover Point for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability Known Exploited Vulnerabilities · Feb 18, 2026CVE-2021-21551: Dell dbutil Driver Insufficient Access Control Vulnerability Known Exploited Vulnerabilities · Mar 31, 2022