Dell CSM Authorization Module: Six Critical Flaws Enable Full Admin Compromise of Kubernetes Storage Infrastructure
Six critical vulnerabilities in the Dell Container Storage Modules (CSM) csm-authorization-storage gRPC service enable unauthenticated remote attackers to gain full administrative control over Kubernetes storage planes. The most severe flaw, CVE-2026-63688 (CVSS 10.0), permits unauthenticated remote code execution via crafted gRPC calls. Chained vulnerabilities allow for privilege escalation, storage class injection, and unauthorized snapshot access, impacting Dell CSI drivers in versions <1.8.0, 1.9.x<1.9.3, and 1.10.x<1.10.1. Successful exploitation allows adversaries to manipulate persistent volumes, exfiltrate data, or deploy ransomware across an estimated 2,000 exposed clusters globally.
Dell PowerProtect Data Domain Privilege Escalation CVE-2026-41124
CVE-2026-41124 is a critical path traversal vulnerability (CWE-22) affecting the Dell PowerProtect Data Domain management interface and API. Attackers can utilize directory traversal sequences (e.g., ../) to bypass restricted directory boundaries, granting unauthorized access to sensitive system files, credential stores, and configuration binaries. This flaw allows an attacker to escalate privileges from a low-privileged or unauthenticated state to administrative or root-level control. Because Data Domain appliances are central to enterprise backup and disaster recovery, this vulnerability poses a severe risk to data availability, potentially enabling threat actors to destroy backup repositories to ensure ransomware success. Remediation is available via Dell Security Advisory DSA-2026-278.