Container Storage Modules CVE-2026-61411

Requires an attacker to already hold low-privileged authenticated access (CVSS PR:L) to an environment running Dell Container Storage Modules prior to version 1.18.0, plus the ability to read the log files the modules generate. Exploitation is remote (AV:N) and low-complexity (AC:L) with no user interaction, but is gated by that prior authentication and by the attacker having visibility into the relevant logs - the vulnerability leaks sensitive information already recorded in those logs rather than requiring any special non-default feature toggle. The limiting factors are the authentication requirement and log-access requirement; there is no public exploit and no confirmed active exploitation to accelerate risk.

This is a moderate-priority issue whose CVSS base score of 7.7 is driven almost entirely by the scope change (S:C) combined with high confidentiality impact (C:H), not by ease of mass exploitation. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N confirms an authenticated (PR:L - low-privileged) attacker with network reach and low complexity can read sensitive information that was improperly written to log files (CWE-532). There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this contrasts with the headline severity and argues against emergency patching. The required prior low-privilege authentication (PR:L) is a meaningful limiting factor that further reduces real-world risk versus a true unauthenticated network flaw. Net assessment: a legitimate but not urgent vulnerability - patch on a normal cadence; the high CVSS reflects the scope/confidentiality combination rather than demonstrated mass exploitability. Note: the exact nature of the leaked data (credentials, tokens, config secrets) is not specified in the Dell summary, so the true downstream impact should be verified against the DSA-2026-448 advisory.

A low-privileged but authenticated user or tenant in a Kubernetes environment running Dell Container Storage Modules gains remote access to log files that the modules populate with sensitive data. By reading those logs, the attacker harvests secrets (such as storage credentials or tokens) they should not be able to see. No public exploit code is known; exploitation requires only existing low-level access and standard log-read capability.