Dell CSM CVE-2026-70411

Exploitation requires that the Dell CSM csm-authorization (authorization-tenant) module is deployed and its gRPC TenantService is reachable, and that the attacker occupies the adjacent network (AV:A) - typically a compromised workload/pod or host on the same Kubernetes cluster network or storage-management segment as CSM; it is not routable from the public internet. No authentication is needed (PR:N per the vendor CVSS vector, consistent with CWE-306 Missing Authentication) and no user interaction (UI:N), so against a reachable, unpatched (pre-1.18.0) deployment there are no further prerequisites. The primary limiting factors are network segmentation/isolation of the CSM control plane and whether the authorization-tenant module is actually in use; environments that do not deploy CSM authorization or that firewall the gRPC service off from untrusted pods are not exposed.

Multiple signals point to a moderate, not top-tier, priority. The vendor-supplied CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N = 7.1 High) indicates an unauthenticated attacker on an adjacent network can exploit a missing authentication check (CWE-306) with low complexity, yielding high integrity impact (unauthorized tenant creation, cross-tenant role injection, modification of storage access-control flags) but only low confidentiality and no availability impact. The adjacency constraint (AV:A) is the single most important risk-limiting factor: this is not internet-wide remotely exploitable, so exposure is confined to attackers who already have a foothold on the same Kubernetes cluster network or storage-management segment. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active or opportunistic exploitation. The combination - High integrity impact but adjacent-only reach, no KEV, no POC - suggests this is a 'patch in normal cycle for affected environments' issue rather than an emergency. Key missing data: no EPSS probability and no SSVC decision values were supplied, so automatability and exploitation-maturity cannot be independently weighed; prioritization should rest on whether Dell CSM authorization module is actually deployed and how segmented the cluster network is.

An attacker who has gained a position on the adjacent network (e.g., a compromised pod or workload on the same Kubernetes cluster/management segment as Dell CSM) sends unauthenticated gRPC requests directly to the csm-authorization-tenant TenantService. Because the service performs no authentication, the attacker creates rogue tenant entities and injects roles across tenant boundaries, then flips storage access-control flags to grant themselves access to other tenants' storage. No public exploit code is identified at time of analysis, but the missing-auth nature makes exploitation straightforward for anyone who can reach the service port.