Container Storage Modules CVE-2026-76105

Exploitation requires LOCAL access (AV:L) to a host or Kubernetes node running Dell Container Storage Modules at a version prior to 1.18.0; the flaw cannot be triggered over the network. The root cause (CWE-330) is the use of insufficiently random values - predictable identifiers, tokens, or keys generated by CSM - which a locally present actor can observe or predict to tamper with information (I:H) and impact availability (A:H). No authentication is needed once local access exists (PR:N) and no user interaction is required (UI:N). The primary limiting factor is the local-access prerequisite, which confines risk to environments where untrusted actors can reach CSM-managed hosts; there is no confidentiality exposure (C:N).

This is a moderate-priority issue rather than a high-urgency one despite its 7.7 (High) CVSS base score. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H is the decisive signal: the attack vector is LOCAL (AV:L), meaning the attacker must already have local access to the host or container environment running Dell Container Storage Modules - this is not a remotely reachable flaw. Although PR:N marks it unauthenticated, that lack of authentication only matters once local access is obtained, which substantially raises the practical bar. The high score is driven entirely by the I:H and A:H impact (integrity tampering and availability), with no confidentiality impact (C:N). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. There is a data conflict worth flagging: the input Tags include 'Information Disclosure,' yet the CVSS vector sets C:N and the description explicitly states 'Information tampering' - this points to an integrity/tampering issue, not disclosure, so the tag appears mislabeled. Net: a genuine but access-gated defense-in-depth concern best handled through normal patch cycles rather than emergency response, prioritized where untrusted local actors could reach CSM-managed nodes.

An attacker who already has local access to a Kubernetes node or container host running Dell Container Storage Modules leverages the insufficiently random values (CWE-330) - such as predictable identifiers, tokens, or keys - to forge or tamper with storage-related information and disrupt availability. Because the CVSS vector is AV:L, remote exploitation is not possible; the attacker must first be present on the host. No public exploit code was identified at time of analysis.