Container Storage Modules Csm
Monthly
Missing authentication in the csm-authorization-tenant gRPC service (TenantService) shipped with Dell Container Storage Modules (CSM) allows an unauthenticated attacker on the adjacent network to create tenant entities, inject roles across tenant boundaries, and modify storage access-control flags on any deployment running CSM authorization prior to 1.18.0. The flaw is rated CVSS 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) reflecting high integrity impact with no authentication and no user interaction required, though it is only reachable from an adjacent network segment rather than the public internet. There is no public exploit identified at time of analysis and no CISA KEV listing; multiple signals point to a moderate, not top-tier, priority, with exposure concentrated in clusters that actually deploy the CSM authorization module and do not segment its gRPC control plane from untrusted pods or hosts.
Improper TLS certificate validation in the Dell Container Storage Modules (CSM) proxy-server component - all versions prior to 1.18.0 - allows an attacker holding an adjacent network position and performing a man-in-the-middle interception of the proxy-server's TLS traffic to impersonate the storage backend and capture storage backend administrator credentials. No authentication or user interaction is required, and the CVSS 3.1 score of 8.2 reflects high confidentiality and integrity impact with scope change, since compromise of the proxy-server crosses into the storage array's administrative domain. Exploitation is constrained by high attack complexity (AC:H) and the adjacency requirement, which keep the flaw off the routable internet; no public exploit code exists and there is no confirmed active exploitation (not in CISA KEV) at time of analysis, making this a credible but conditional priority for environments where CSM proxy-server traffic is not isolated to a trusted segment.
Privilege escalation in Dell Container Storage Modules (CSM) Operator versions prior to 1.18.0 allows an authenticated, low-privileged attacker who can create or modify the ContainerStorageModule Custom Resource to obtain root-level access on Kubernetes cluster nodes. The flaw is an improper privilege management weakness (CWE-269) in the ContainerStorageModule Custom Resource reconciler, rated CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) because the impact crosses a security scope boundary and delivers total confidentiality, integrity, and availability impact against the underlying nodes. Exploitation is not unrestricted: it requires a low-privileged cluster credential with rights to submit or alter the CSM Custom Resource (PR:L, no user interaction), so multi-tenant clusters that grant this permission broadly are the highest-risk deployments. No public exploit code has been identified at time of analysis and no CISA KEV entry exists; EPSS data was not provided.
Missing authentication in the csm-authorization-tenant gRPC service (TenantService) shipped with Dell Container Storage Modules (CSM) allows an unauthenticated attacker on the adjacent network to create tenant entities, inject roles across tenant boundaries, and modify storage access-control flags on any deployment running CSM authorization prior to 1.18.0. The flaw is rated CVSS 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) reflecting high integrity impact with no authentication and no user interaction required, though it is only reachable from an adjacent network segment rather than the public internet. There is no public exploit identified at time of analysis and no CISA KEV listing; multiple signals point to a moderate, not top-tier, priority, with exposure concentrated in clusters that actually deploy the CSM authorization module and do not segment its gRPC control plane from untrusted pods or hosts.
Improper TLS certificate validation in the Dell Container Storage Modules (CSM) proxy-server component - all versions prior to 1.18.0 - allows an attacker holding an adjacent network position and performing a man-in-the-middle interception of the proxy-server's TLS traffic to impersonate the storage backend and capture storage backend administrator credentials. No authentication or user interaction is required, and the CVSS 3.1 score of 8.2 reflects high confidentiality and integrity impact with scope change, since compromise of the proxy-server crosses into the storage array's administrative domain. Exploitation is constrained by high attack complexity (AC:H) and the adjacency requirement, which keep the flaw off the routable internet; no public exploit code exists and there is no confirmed active exploitation (not in CISA KEV) at time of analysis, making this a credible but conditional priority for environments where CSM proxy-server traffic is not isolated to a trusted segment.
Privilege escalation in Dell Container Storage Modules (CSM) Operator versions prior to 1.18.0 allows an authenticated, low-privileged attacker who can create or modify the ContainerStorageModule Custom Resource to obtain root-level access on Kubernetes cluster nodes. The flaw is an improper privilege management weakness (CWE-269) in the ContainerStorageModule Custom Resource reconciler, rated CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) because the impact crosses a security scope boundary and delivers total confidentiality, integrity, and availability impact against the underlying nodes. Exploitation is not unrestricted: it requires a low-privileged cluster credential with rights to submit or alter the CSM Custom Resource (PR:L, no user interaction), so multi-tenant clusters that grant this permission broadly are the highest-risk deployments. No public exploit code has been identified at time of analysis and no CISA KEV entry exists; EPSS data was not provided.