Multiple vulnerability on Dell CSM Authorization Proxy - Unauthenticated Admin Access & Unauthenticated Auth Bypass to Admin & Unauthenticated Admin Bypass on Storage Backend & Token Forgery to Admin & Unauthenticated Root RCE on Cluster Nodes
Dell Container Storage Modules (CSM) is a suite of open-source plugins that enables enterprise storage integration with Kubernetes, allowing developers to automate advanced storage capabilities such as provisioning, replication, observability, and authorization within containerized environments. CVE-2026-63692 Critical vulnerability resides within the Authorization Proxy and Tenant service of Dell Container Storage Modules. Due to an improper implementation of access control checks, an unauthenticated, remote attacker can completely bypass authentication protocols. This flaw grants the attacker full access to underlying storage tenants and proxy administration mechanisms, enabling them to read, alter, or delete crucial persistent data volumes without requiring any valid user credentials or interacting with existing platform accounts. CVE-2026-63688 Located in the gRPC server component utilized by Dell Container Storage Modules, this flaw stems from a severe flaw in network communications handling. A remote, unauthenticated threat actor can interact directly with the open gRPC endpoint to extract highly sensitive data, specifically storage administrator credentials and session tokens. With these stolen components, the attacker can impersonate legitimate cluster administrators, compromising the overall confidentiality and integrity of the integrated infrastructure. CVE-2026-67269 This high-severity vulnerability allows a low-privileged local user within a Kubernetes environment to achieve complete cluster escalation. By submitting a maliciously crafted Custom Resource (CR) to the container management framework, the attacker triggers an improper validation loop. This exploit breaks isolation barriers, granting the user unauthorized administrative privileges across all connected cluster nodes, thereby putting the entire infrastructure's integrity and workload availability at severe risk. CVE-2026-54472 Stemming from the presence of default or hardcoded credentials within public deployment source code (such as Helm charts or Operator files), this flaw provides unauthenticated remote threat actors with an immediate entry point. Attackers can leverage these static credentials to forge administrative tokens, bypass identity providers, and gain unauthorized access to core storage modules. This allows them to manipulate configuration baselines or exfiltrate cached sensitive cluster data. CVE-2026-61421 This security flaw originates from an unrotated legacy JSON Web Token (JWT) signing secret that was inadvertently left in older configuration guides. Remote attackers can easily reuse this publicly documented static key to craft valid, signed administrative JWTs. By sending these forged tokens to the live system API, the attacker is recognized as a trusted administrator, granting them the ability to view configuration logs and modify tenant storage parameters without triggering any authentication alerts.
