Dell CSM Vulnerability Advisory: Multiple CVEs including Missing Auth, Privilege Escalation, and RCE

Vulnerability Overview Dell Container Storage Modules (CSM) contains multiple security vulnerabilities that could lead to unauthorized access, privilege escalation, information disclosure, and other security issues. The specific vulnerabilities include: 1. CVE-2026-63688: Missing authentication in the , which could lead to unauthorized access to storage backend administrator credentials. 2. CVE-2026-63692: Missing authentication in the , which could lead to privilege escalation. 3. CVE-2026-67269: Improper permission management in the , which could lead to privilege escalation and root-level access on cluster nodes. 4. CVE-2026-54472: Hardcoded credentials in , which could lead to information disclosure. 5. CVE-2026-61421: Hardcoded credentials in , which could lead to privilege escalation. 6. CVE-2026-67273: Improper neutralization of special elements in the template engine, which could lead to privilege escalation. 7. CVE-2026-67270: Improper certificate verification in the proxy server component, which could lead to information disclosure of storage backend administrator credentials. 8. CVE-2026-76105: Insufficient random values, which could lead to information tampering. 9. CVE-2026-61411: Injection of sensitive information into log files, which could lead to information disclosure. 10. CVE-2026-70411: Missing authentication in the , which could lead to unauthorized tenant entity creation, cross-tenant role injection, and modification of storage access control flags. 11. CVE-2026-63689: Injection of sensitive information into log files, which could lead to information disclosure. 12. CVE-2026-63691: Missing authorization in Dell CSI Driver for PowerMax - , which could lead to unauthorized access. 13. CVE-2026-63690: Missing authentication in , , and , which could lead to information disclosure. Affected Products Affected Product: Dell Container Storage Modules (CSM) Affected Versions: Versions prior to 1.18.0 Remediation Fixed Version: 1.18.0 or later Remediation Link: https://eos2git.cec.lab.emc.com/Ecosystems/container-storage-modules Additional Information CVSS Score: The CVSS Base Scores for the vulnerabilities range from 5.4 to 10.0. CVSS Vector Strings: Each vulnerability has a specific CVSS vector string used to describe its characteristics. Credits CVE-2026-63688, CVE-2026-63692, CVE-2026-67270, CVE-2026-61411, CVE-2026-63689, CVE-2026-63691, CVE-2026-63690: Thanks to chwid for reporting these issues. CVE-2026-67269: Thanks to SuperDevSecurity for reporting this issue. CVE-2026-54472: Thanks to lolsaii for reporting this issue. CVE-2026-61421: Thanks to heyyaaii for reporting this issue. CVE-2026-67273: Thanks to rudra_16 for reporting this issue. Legal Disclaimer The Dell Technologies security advisory should be read and used to help avoid situations that may be caused by the described issues. Dell Technologies distributes security advisories to alert users of affected products about important security information. Dell Technologies evaluates risks based on the diversity of installed systems and does not imply actual risk levels. It is recommended that all users determine the applicability of the information and take appropriate action. Information is provided "as is" without any type of warranty. Dell Technologies expressly disclaims all warranties, whether express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, and non-infringement. Under no circumstances shall Dell Technologies, its affiliates, or suppliers be liable for any direct, indirect, incidental, consequential, loss of business profits, or special damages, even if advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the above limitation may not apply. Affected Products Container Storage Modules Provide Feedback Accurate, Useful, Easy to understand

Goal Reached Thanks to every supporter — we hit 100%!

Dell CSM Vulnerability Advisory: Multiple CVEs including Missing Auth, Privilege Escalation, and RCE