Dell Container Storage Modules Csm
Monthly
Unauthenticated remote credential theft in the Dell Container Storage Modules (CSM) Authorization component before v1.18.0 allows any attacker who can reach the csm-authorization-storage gRPC service to retrieve the storage-backend administrator credentials for every registered storage array, turning a single unauthenticated request path into full administrative control of the underlying storage infrastructure. The defect is a missing-authentication error (CWE-306) in a critical function and carries a CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), with the scope change reflecting the pivot from the CSM authorization service into the storage arrays themselves. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the principal gating factors are environmental - the optional Authorization module must be deployed, its gRPC endpoint must be reachable from the attacker's network position, and at least one array must already be onboarded so that credentials exist to steal - which is why Dell's DSA-2026-448 advisory and the availability of a fixed release make this a genuine top-priority item rather than a theoretical high-CVSS score.
Unauthenticated remote credential theft in the Dell Container Storage Modules (CSM) Authorization component before v1.18.0 allows any attacker who can reach the csm-authorization-storage gRPC service to retrieve the storage-backend administrator credentials for every registered storage array, turning a single unauthenticated request path into full administrative control of the underlying storage infrastructure. The defect is a missing-authentication error (CWE-306) in a critical function and carries a CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), with the scope change reflecting the pivot from the CSM authorization service into the storage arrays themselves. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the principal gating factors are environmental - the optional Authorization module must be deployed, its gRPC endpoint must be reachable from the attacker's network position, and at least one array must already be onboarded so that credentials exist to steal - which is why Dell's DSA-2026-448 advisory and the availability of a fixed release make this a genuine top-priority item rather than a theoretical high-CVSS score.