Container Storage Modules
Monthly
Missing authentication for critical functions in Dell Container Storage Modules' CSI drivers (csi-powerflex, csi-powermax and csi-powerstore) at versions prior to 1.18.0 allows an unauthenticated attacker with adjacent network access to read sensitive information from the Kubernetes storage layer, with no user interaction required (CVSS 7.4, scope-changed, high confidentiality impact only). Affected environments are limited to those that have actually deployed one of these three Dell CSI drivers alongside the corresponding Dell storage array; the vector is AV:A, so the flaw is not reachable from an arbitrary internet host but only from a host on the same logical or physical network segment as the cluster. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none and automatable as no, and EPSS is 0.30% (21st percentile), so this is a moderate-priority hardening item rather than an emergency; a vendor patch is available in 1.18.0.
Missing authorization in the PowerMax CSI Driver's csireverseproxy component of Dell Container Storage Modules before 1.18.0 allows unauthenticated attackers with adjacent-network access to perform unauthorized actions, with high confidentiality, integrity, and availability impact in a changed-scope CVSS 9.6 scenario. The flaw is only reachable from the cluster or storage-management network, not the public internet, and requires the PowerMax CSI driver to be deployed and network-exposed. No public exploit was identified at time of analysis and EPSS is low at 0.23% (13th percentile), while a vendor patch is available in 1.18.0.
Dell Container Storage Modules releases before 1.18.0 write sensitive information into their log files, so a low-privileged, authenticated remote user who can read those logs can obtain credentials, tokens, or other confidential data recorded there. The issue carries a CVSS 3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), inflated primarily by the scope change to components beyond the vulnerable module rather than by ease of mass exploitation. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), so the practical risk is bounded by the prerequisite of existing low-privileged authentication plus read access to the module's log output.
Integrity and availability tampering in Dell Container Storage Modules before 1.18.0 stems from use of insufficiently random values (CWE-330), allowing a local attacker to corrupt integrity-sensitive data or disrupt availability on a host or Kubernetes node running the modules. Exploitation requires local access (AV:L) and no user interaction; the CVSS 7.1 vector rates integrity and availability impact high while confidentiality is unaffected. No public exploit has been identified at time of analysis - EPSS is 0.16% (4th percentile) and CISA SSVC marks exploitation as none - making this a moderate, low-priority issue; the vendor's 'unauthenticated' wording conflicts with the PR:L vector and should be verified against Dell DSA-2026-448.
Server-side template injection in Dell Container Storage Modules (CSM) releases prior to 1.18.0 allows a low-privileged authenticated remote user to escalate privileges within and beyond the affected component, with a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). The flaw is rated Scope:Changed with high confidentiality and integrity impact and no availability impact, meaning a compromise of the template-evaluating component can cross a security boundary and affect resources the attacker would not normally control. At time of analysis there is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit identified; the practical barrier is that a valid low-privilege account with network access to CSM is required before the injection can be delivered.
Unauthenticated remote attackers can gain elevated privileges against Dell Container Storage Modules deployments because the CSM Authorization component ships with hard-coded credentials, as described in CWE-798 and scored CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Every CSM release prior to 1.18.0 is affected per the vendor advisory DSA-2026-448, and exploitation requires only that the CSM Authorization service be deployed and reachable over the network - no account, token, or user interaction is needed. Exposure is bounded by deployment footprint: only Kubernetes clusters using CSM Authorization to front Dell storage arrays are at risk, and network segmentation that keeps the authorization service off untrusted networks materially reduces reachability. No public exploit code and no confirmed active exploitation were identified at the time of analysis, but the unauthenticated, no-interaction exploit profile makes this a high-priority patch candidate.
Hard-coded credentials embedded in the csm-docs component of Dell Container Storage Modules (CSM) before version 1.18.0 expose sensitive information to remote attackers who can reach the affected service over the network. Per the CVSS vector (PR:N/UI:N), no legitimate authentication or user interaction is required once a network path exists, although the attacker must know the embedded credentials, and impact is confined to confidentiality (C:H with I:N/A:N). No public exploit code or active exploitation has been identified at time of analysis (SSVC Exploitation: none, not in CISA KEV); EPSS is low at 0.54% (44th percentile), and Dell has released a fixed version, CSM 1.18.0.
Unauthenticated remote attackers can exploit Dell Container Storage Modules (CSM) deployments running versions prior to 1.18.0 to elevate privileges, because a critical function is reachable without any authentication check (CWE-306); the vendor scores this CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and our independent assessment concurs that this is a genuine top-priority issue rather than a high-score/low-risk artifact. Per the provided CVSS vector the attack is unauthenticated, requires no user interaction, and involves no special difficulty (AC:L), so any party who can route traffic to the vulnerable CSM endpoint can trigger it. The decisive limiting factor is network exposure of that endpoint - CSM components frequently run inside a Kubernetes cluster, so realistic blast radius depends on whether the deployed service is reachable from an attacker-controlled network segment. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
OS command injection in Dell Container Storage Modules (CSM) version 2.16.0 - spanning the csi-powerstore, csi-unity, csi-powerflex, and csi-powermax CSI drivers - lets a remote, high-privileged attacker inject and execute arbitrary operating-system commands (CWE-78). Successful exploitation yields full confidentiality, integrity, and availability impact with a scope change, meaning command execution can reach beyond the vulnerable component into the surrounding host or cluster. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 3.1 base score is 8.0 (High).
Log-file information disclosure in Dell Container Storage Modules (CSM) versions prior to 1.18.0 allows a low-privileged but authenticated remote user to obtain sensitive data that the components write into their own log files (CWE-532). The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (6.5) confirms confidentiality-only impact with no integrity or availability effect, and exploitation presupposes that the attacker already holds a valid account plus read access to the generated logs, making this a moderate rather than a top-tier priority. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Dell Container Storage Modules 1.2 contains an OS Command Injection in goiscsi and gobrick libraries. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Dell Container Storage Modules 1.2 contains an Improper Limitation of a Pathname to a Restricted Directory in goiscsi and gobrick libraries which could lead to OS command injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Dell Container Storage Modules 1.2 contains a path traversal vulnerability in goiscsi and gobrick libraries. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Dell Container Storage Modules 1.2 contains an OS command injection in goiscsi and gobrick libraries. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Missing authentication for critical functions in Dell Container Storage Modules' CSI drivers (csi-powerflex, csi-powermax and csi-powerstore) at versions prior to 1.18.0 allows an unauthenticated attacker with adjacent network access to read sensitive information from the Kubernetes storage layer, with no user interaction required (CVSS 7.4, scope-changed, high confidentiality impact only). Affected environments are limited to those that have actually deployed one of these three Dell CSI drivers alongside the corresponding Dell storage array; the vector is AV:A, so the flaw is not reachable from an arbitrary internet host but only from a host on the same logical or physical network segment as the cluster. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none and automatable as no, and EPSS is 0.30% (21st percentile), so this is a moderate-priority hardening item rather than an emergency; a vendor patch is available in 1.18.0.
Missing authorization in the PowerMax CSI Driver's csireverseproxy component of Dell Container Storage Modules before 1.18.0 allows unauthenticated attackers with adjacent-network access to perform unauthorized actions, with high confidentiality, integrity, and availability impact in a changed-scope CVSS 9.6 scenario. The flaw is only reachable from the cluster or storage-management network, not the public internet, and requires the PowerMax CSI driver to be deployed and network-exposed. No public exploit was identified at time of analysis and EPSS is low at 0.23% (13th percentile), while a vendor patch is available in 1.18.0.
Dell Container Storage Modules releases before 1.18.0 write sensitive information into their log files, so a low-privileged, authenticated remote user who can read those logs can obtain credentials, tokens, or other confidential data recorded there. The issue carries a CVSS 3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), inflated primarily by the scope change to components beyond the vulnerable module rather than by ease of mass exploitation. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), so the practical risk is bounded by the prerequisite of existing low-privileged authentication plus read access to the module's log output.
Integrity and availability tampering in Dell Container Storage Modules before 1.18.0 stems from use of insufficiently random values (CWE-330), allowing a local attacker to corrupt integrity-sensitive data or disrupt availability on a host or Kubernetes node running the modules. Exploitation requires local access (AV:L) and no user interaction; the CVSS 7.1 vector rates integrity and availability impact high while confidentiality is unaffected. No public exploit has been identified at time of analysis - EPSS is 0.16% (4th percentile) and CISA SSVC marks exploitation as none - making this a moderate, low-priority issue; the vendor's 'unauthenticated' wording conflicts with the PR:L vector and should be verified against Dell DSA-2026-448.
Server-side template injection in Dell Container Storage Modules (CSM) releases prior to 1.18.0 allows a low-privileged authenticated remote user to escalate privileges within and beyond the affected component, with a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). The flaw is rated Scope:Changed with high confidentiality and integrity impact and no availability impact, meaning a compromise of the template-evaluating component can cross a security boundary and affect resources the attacker would not normally control. At time of analysis there is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit identified; the practical barrier is that a valid low-privilege account with network access to CSM is required before the injection can be delivered.
Unauthenticated remote attackers can gain elevated privileges against Dell Container Storage Modules deployments because the CSM Authorization component ships with hard-coded credentials, as described in CWE-798 and scored CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Every CSM release prior to 1.18.0 is affected per the vendor advisory DSA-2026-448, and exploitation requires only that the CSM Authorization service be deployed and reachable over the network - no account, token, or user interaction is needed. Exposure is bounded by deployment footprint: only Kubernetes clusters using CSM Authorization to front Dell storage arrays are at risk, and network segmentation that keeps the authorization service off untrusted networks materially reduces reachability. No public exploit code and no confirmed active exploitation were identified at the time of analysis, but the unauthenticated, no-interaction exploit profile makes this a high-priority patch candidate.
Hard-coded credentials embedded in the csm-docs component of Dell Container Storage Modules (CSM) before version 1.18.0 expose sensitive information to remote attackers who can reach the affected service over the network. Per the CVSS vector (PR:N/UI:N), no legitimate authentication or user interaction is required once a network path exists, although the attacker must know the embedded credentials, and impact is confined to confidentiality (C:H with I:N/A:N). No public exploit code or active exploitation has been identified at time of analysis (SSVC Exploitation: none, not in CISA KEV); EPSS is low at 0.54% (44th percentile), and Dell has released a fixed version, CSM 1.18.0.
Unauthenticated remote attackers can exploit Dell Container Storage Modules (CSM) deployments running versions prior to 1.18.0 to elevate privileges, because a critical function is reachable without any authentication check (CWE-306); the vendor scores this CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and our independent assessment concurs that this is a genuine top-priority issue rather than a high-score/low-risk artifact. Per the provided CVSS vector the attack is unauthenticated, requires no user interaction, and involves no special difficulty (AC:L), so any party who can route traffic to the vulnerable CSM endpoint can trigger it. The decisive limiting factor is network exposure of that endpoint - CSM components frequently run inside a Kubernetes cluster, so realistic blast radius depends on whether the deployed service is reachable from an attacker-controlled network segment. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
OS command injection in Dell Container Storage Modules (CSM) version 2.16.0 - spanning the csi-powerstore, csi-unity, csi-powerflex, and csi-powermax CSI drivers - lets a remote, high-privileged attacker inject and execute arbitrary operating-system commands (CWE-78). Successful exploitation yields full confidentiality, integrity, and availability impact with a scope change, meaning command execution can reach beyond the vulnerable component into the surrounding host or cluster. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 3.1 base score is 8.0 (High).
Log-file information disclosure in Dell Container Storage Modules (CSM) versions prior to 1.18.0 allows a low-privileged but authenticated remote user to obtain sensitive data that the components write into their own log files (CWE-532). The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (6.5) confirms confidentiality-only impact with no integrity or availability effect, and exploitation presupposes that the attacker already holds a valid account plus read access to the generated logs, making this a moderate rather than a top-tier priority. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Dell Container Storage Modules 1.2 contains an OS Command Injection in goiscsi and gobrick libraries. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Dell Container Storage Modules 1.2 contains an Improper Limitation of a Pathname to a Restricted Directory in goiscsi and gobrick libraries which could lead to OS command injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Dell Container Storage Modules 1.2 contains a path traversal vulnerability in goiscsi and gobrick libraries. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Dell Container Storage Modules 1.2 contains an OS command injection in goiscsi and gobrick libraries. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.