Critical Dell Container Storage CVE-2024-29001 Flaws Let Attackers Gain Admin Control

Key Takeaways

• Dell has issued critical security updates for its Container Storage Modules (CSM) to address multiple severe vulnerabilities.
• The flaws, some rated CVSS 10.0, could allow unauthenticated remote attackers to achieve full administrative control over affected storage environments.
• Versions of Dell Container Storage Modules prior to 1.17.0 are impacted, with fixes available in version 1.18.0 and later.
• No workarounds are available, making immediate patching essential for all organizations utilizing vulnerable deployments.

Dell has released a crucial security advisory, DSA-2026-448, detailing a series of critical vulnerabilities within its Container Storage Modules (CSM). These security gaps are severe, with several allowing unauthenticated remote attackers to seize complete administrative control over vital storage infrastructure. Organizations leveraging Dell CSM deployments are urged to upgrade immediately, as Dell has confirmed that no alternative mitigations or workarounds exist.

The advisory specifically targets Dell Container Storage Modules versions preceding 1.17.0. Patches are incorporated into version 1.18.0 and subsequent releases. The scope of the fix encompasses various components, including CSM Authorization, CSM Operator, several CSI components, and underlying third-party Go libraries.

Highest-Severity Vulnerabilities

Among the most alarming issues are CVE-2026-63688 and CVE-2026-63692, both of which have been assigned a maximum CVSS score of 10.0. CVE-2026-63688 is identified as a critical missing authentication vulnerability residing within the csm-authorization-storage gRPC server in CSM Authorization version 2.4.0.

Exploitation of this flaw would grant an unauthenticated attacker access to administrator credentials for all registered storage arrays. This could potentially compromise control across all five of Dell’s supported storage product families, enabling widespread unauthorized operations. Such access to backend administrator credentials could facilitate unauthorized changes to storage configurations, exposure of sensitive data, disruption of critical workloads, or the establishment of persistent backdoors within the environment.

CVE-2026-63692 also impacts CSM Authorization version 2.4.0, specifically affecting the authorization proxy and tenant service. This vulnerability allows critical functions to be accessed without proper authentication. A successful network-based attacker could bypass existing authentication controls, escalating privileges to an administrative level, thereby exposing and enabling manipulation of storage resources across all tenants.

Additional Critical Flaws

Another significant vulnerability, CVE-2026-54472, rated CVSS 9.8, involves hard-coded credentials within CSM Authorization. This flaw could permit an unauthenticated remote attacker to forge cryptographically valid administrative JSON Web Tokens (JWTs), thereby gaining administrator access to the CSM Authorization proxy. Dell advises rotating JWT signing secrets immediately after applying the update. The advisory also addresses CVE-2026-61421, found in the archived karavi-authorization component.

Dell has pointed out that older documentation inadvertently used “supersecret” as a JWT signing secret in conjunction with a real token example. Organizations that deployed karavi-authorization using this documented value and failed to change the default signing secret may remain vulnerable to forged-token attacks and subsequent administrative takeover.

Furthermore, CVE-2026-67269, affecting Dell CSM Operator 1.12.0, carries a CVSS score of 9.9. This vulnerability could allow low-privileged remote users to gain root access to Kubernetes nodes through a maliciously crafted ContainerStorageModule resource, posing a risk of cluster-wide compromise. Another high-severity flaw, CVE-2026-67273, rated 9.6, could enable a low-privileged attacker to access Kubernetes Secrets and create cluster-scoped RBAC resources via template-engine injection. This could effectively bypass intended Kubernetes permissions, granting broad control over cluster resources.

The update also rectifies other issues, including improper certificate validation, missing authorization in the Dell CSI Driver for PowerMax, sensitive information disclosure through logs, and various flaws impacting CSI drivers for PowerFlex, PowerMax, and PowerStore. Vulnerabilities in third-party Go components, such as golang.org/x/crypto, golang.org/x/net, golang-jwt/jwt, and protobuf, are also addressed.

What You Should Do

• Dell recommends upgrading all affected Container Storage Modules deployments to version 1.18.0 or later as soon as possible.
• Immediately rotate JWT signing secrets within your environment.
• Review CSM Authorization access logs thoroughly for any signs of suspicious activity.
• Audit administrative token usage to detect unauthorized or anomalous access.
• Inspect Kubernetes RBAC policies and custom resources for any unauthorized modifications or creations.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.