EUVD-2026-93437
GHSA-hr2q-g63x-jc3v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach CSM Authorization endpoint over network
-
DeliveryRecover hard-coded credential from image
-
ExploitAuthenticate as privileged identity
-
ExecutionElevate privileges in CSM Authorization
-
ImpactCompromise storage authorization control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a deployment running the CSM Authorization component of Dell Container Storage Modules at a version prior to 1.18.0, with that service reachable over the network from the attacker. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or non-default configuration is otherwise needed beyond having the vulnerable CSM Authorization module in use. The primary limiting factor is deployment footprint: only environments that run Dell storage arrays integrated with Kubernetes via CSM Authorization are exposed, and network segmentation that isolates the authorization service from untrusted networks materially reduces reachability. |
| Impact | All provided signals point to a genuinely high-priority flaw rather than a CVSS-inflated low-risk issue. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with full C/I/A impact (9.8 Critical), and CWE-798 (hard-coded credentials) is highly consistent with that vector because embedded static credentials require no privilege or user interaction to abuse. The weakness is deterministic and reliable once the credential is known - hard-coded secrets are typically reverse-engineered from the product image and then reused identically across every deployment, which is why this class is favored for broad, automatable abuse. Key risk-amplifying and mitigating signals are MISSING from the input and must be stated explicitly: no EPSS probability was provided, there is no CISA KEV listing in the data, and no POC/exploit-code indicator was supplied, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data to cite. The vector and CWE are internally consistent (no conflict between network vector and description), so the main uncertainty is temporal/empirical exploitation likelihood, not the technical severity. Net: treat as a priority patch for any environment running Dell CSM Authorization, while recognizing active exploitation is not currently evidenced in the provided data. |
| Exploit ScenarioDerived | An unauthenticated attacker with network access to a Kubernetes cluster's Dell CSM Authorization service extracts the hard-coded credential (recoverable from the publicly distributed container image) and authenticates as a privileged identity. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only reachability to the service and no user interaction, yielding elevation of privileges with full confidentiality, integrity, and availability impact. No public exploit code is identified in the provided data at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated remote attackers can gain elevated privileges against Dell Container Storage Modules deployments because the CSM Authorization component ships with hard-coded credentials, as described in CWE-798 and scored CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Every CSM release prior to 1.18.0 is affected per the vendor advisory DSA-2026-448, and exploitation requires only that the CSM Authorization service be deployed and reachable over the network - no account, token, or user interaction is needed. Exposure is bounded by deployment footprint: only Kubernetes clusters using CSM Authorization to front Dell storage arrays are at risk, and network segmentation that keeps the authorization service off untrusted networks materially reduces reachability. No public exploit code and no confirmed active exploitation were identified at the time of analysis, but the unauthenticated, no-interaction exploit profile makes this a high-priority patch candidate.
RemediationAI
Vendor-released patch: upgrade Dell Container Storage Modules to 1.18.0 or later, which removes the hard-coded credentials from the CSM Authorization component; apply the update to every deployed module (the Authorization server/proxy components in particular) and restart the affected pods so the new images take effect, using the fixed release referenced in Dell advisory DSA-2026-448 (https://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities). Because the secret is embedded rather than generated, rotating cluster passwords or Kubernetes Secrets on a pre-1.18.0 install does not close the hole, so the upgrade must not be deferred to a maintenance window. If 1.18.0 cannot be deployed immediately, the most effective compensating control is network isolation of the CSM Authorization service: restrict ingress with Kubernetes NetworkPolicies, a service mesh authorization policy, or firewall rules so that only the CSI driver components and cluster nodes that legitimately call it can reach it, and block it from any untrusted or user-facing network segment - the trade-off is that overly broad policy changes can break dynamic provisioning and quota enforcement if the driver namespace is not whitelisted correctly. Where per-tenant storage authorization is not actually required, uninstalling or disabling the Authorization module removes the attack surface entirely, at the cost of losing its access-control and quota features. Any credential or token handled by the Authorization component should be treated as known to attackers and rotated after the upgrade, and logs from the Authorization service should be reviewed for anomalous or unexpected authentication attempts during the pre-patch window.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dell Container Storage Modules (CSM) is a suite of Kubernetes-native modules that provide CSI-based provisioning and management for Dell storage platforms, and its Authorization component acts as the access-control layer that brokers and validates storage requests between cluster workloads and the backend arrays, enforcing tenant quotas, role separation, and token-based authentication. The root cause here is CWE-798, Use of Hard-coded Credentials: rather than deriving secrets at install time or from a Kubernetes Secret, the Authorization component embeds credentials directly in the shipped code, container image, or default configuration. Because those values are static and publicly recoverable from distributed artifacts, an attacker who can reach the service can replay them to authenticate as a privileged identity, which explains the elevation-of-privileges impact and the critical Confidentiality/Integrity/Availability ratings. The CVSS vector's PR:N, UI:N, and AC:L parameters confirm that the hard-coded secret is sufficient on its own - the attacker needs no initial foothold in the cluster and no non-default configuration beyond having the module deployed and network-reachable. Static credentials also mean the exposure cannot be remediated by rotation alone: any environment running a pre-1.18.0 build keeps the same embedded secret regardless of local password changes, so upgrade is the only durable fix. The CPE entry cpe:2.3:a:dell:container_storage_modules:*:*:*:*:*:*:*:* reflects a whole-product version match, i.e. all CSM versions before the fixed release, with the Authorization module being the exploitable surface.
Know when Container Storage Modules gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Hard-coded credentials allow unauthenticated network access (AV:N/AC:L/PR:N/UI:N), and privilege elevation over the authorization component yields full C/I/A impact.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
Articles & Coverage 1
Executive ViewAI
Dell Container Storage Modules (CSM) Authorization, the component that mediates access to Dell storage arrays in Kubernetes environments, is affected by hard-coded credentials that any network-reachable attacker can use without authentication or user interaction, giving them the same elevated privileges the service itself holds over protected storage. Every CSM release prior to 1.18.0 is affected, so leadership should care because the affected component is the trust boundary guarding enterprise data stores, and a compromise there can expose or corrupt the data of every application backed by those arrays. Exposure is bounded to clusters that actually deploy CSM Authorization and expose it beyond trusted network segments, so impact and urgency should be scoped to that deployment footprint.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce strict network segmentation so the CSM Authorization service is unreachable from untrusted networks (Kubernetes NetworkPolicies, firewall rules, private ingress only); remove public or broad internal exposure of the authorization service; disable or decommission CSM Authorization where it is not operationally required; override and rotate hard-coded default credentials wherever the component allows configuration; monitor and alert on authentication and API activity against the service for signs of abuse; and apply equivalent isolation to non-production and disaster-recovery clusters. Note that the vulnerability is unauthenticated and requires no user interaction, so network reachability is the primary control surface.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Container Storage Modules
View allUnauthenticated remote attackers can exploit Dell Container Storage Modules (CSM) deployments running versions prior to
Server-side template injection in Dell Container Storage Modules (CSM) releases prior to 1.18.0 allows a low-privileged
Dell Container Storage Modules 1.2 contains an OS Command Injection in goiscsi and gobrick libraries. Rated high severit
Dell Container Storage Modules 1.2 contains an Improper Limitation of a Pathname to a Restricted Directory in goiscsi an
Dell Container Storage Modules 1.2 contains an OS command injection in goiscsi and gobrick libraries. Rated high severit
OS command injection in Dell Container Storage Modules (CSM) version 2.16.0 - spanning the csi-powerstore, csi-unity, cs
Dell Container Storage Modules releases before 1.18.0 write sensitive information into their log files, so a low-privile
Predictable, insufficiently random values in Dell Container Storage Modules (CSM) before 1.18.0 allow an unauthenticated
Hard-coded credentials embedded in the csm-docs component of Dell Container Storage Modules (CSM) before version 1.18.0
Log-file information disclosure in Dell Container Storage Modules (CSM) versions prior to 1.18.0 allows a low-privileged
Dell Container Storage Modules 1.2 contains a path traversal vulnerability in goiscsi and gobrick libraries. Rated mediu
Missing authorization in the csireverseproxy component of Dell's CSI Driver for PowerMax, shipped as part of Dell Contai
Exploit-DB