Dell CSM Operator EUVD-2026-93432

Exploitation requires (1) a running deployment of Dell Container Storage Modules (CSM) Operator at a version prior to 1.18.0, and (2) an attacker holding low-privileged access within the Kubernetes cluster sufficient to create or modify the ContainerStorageModule Custom Resource that the vulnerable reconciler processes (PR:L). No user interaction is needed (UI:N). The principal LIMITING factor is the authentication/RBAC prerequisite: a fully anonymous external attacker cannot trigger this without first obtaining a low-privileged cluster credential or namespace foothold, so clusters that tightly restrict who can submit/alter the CSM Custom Resource materially reduce exposure. The payoff - root on cluster nodes via a scope change (S:C) - makes multi-tenant clusters the highest-risk deployments.

Vendor-assigned CVSS 3.1 is 9.9 (Critical) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a network-reachable, low-complexity flaw that requires only low privileges, needs no user interaction, and crosses a security scope boundary to deliver total confidentiality, integrity, and availability impact. The scope change (S:C) combined with the description's claim of root-level access on cluster nodes is the key driver of the near-maximal score: a constrained low-privilege actor escalates to full node compromise. However, several real-world risk signals are MISSING from the input and must not be assumed: no EPSS exploitation-probability score was provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis. The PR:L metric confirms this is NOT an unauthenticated internet-wide threat; the attacker must already hold some low-privileged foothold within the Kubernetes cluster (e.g., a namespace tenant or a limited service account) able to interact with the ContainerStorageModule Custom Resource. Net assessment: this is a genuinely high-priority flaw for the specific population running Dell CSM Operator, because privilege escalation to node root collapses tenant isolation - but the absence of KEV/POC/EPSS data means there is no evidence of active or imminent widespread exploitation, so it reads as a high-severity-but-prerequisite-gated issue rather than a confirmed in-the-wild emergency. Prioritize patching where Dell CSM is deployed on multi-tenant clusters; verify the authentication prerequisite against your own RBAC before treating it as fully remote.

A low-privileged tenant or compromised service account within a Kubernetes cluster running Dell CSM Operator (prior to 1.18.0) crafts or modifies a ContainerStorageModule Custom Resource whose reconciler mishandles privilege boundaries. The malicious CR causes the operator to provision or run workloads with excessive privileges, yielding root-level code execution on the underlying cluster nodes and breaking tenant isolation. No public exploit code is identified at time of analysis, and exploitation requires an existing authenticated foothold (PR:L) rather than anonymous network access.